An organization is replacing its internal human resources system with a SaaS-based application. The solution is multi-tenant, and the organization wants to ensure ubiquitous access while preventing…

Destination resource authentication is a generic access-control concept that does not inherently produce one-time or time-bound credentials, so it does not block an attacker from successfully replaying a captured credential.

2FA requires a second authentication factor - such as a TOTP code or hardware push notification - that is valid only once or for a short time window, so a replayed password alone is insufficient for an attacker to gain access. This directly addresses the replay attack risk in a multi-tenant SaaS environment where credentials may traverse shared infrastructure. Ubiquitous access is preserved because authenticator apps and hardware tokens are portable and not tied to a specific network location.

Removing local administrator privileges reduces the risk of malware escalation on endpoints but does not prevent an attacker from replaying captured SaaS credentials against a remotely hosted application.

A combined physical-and-network authentication card requires physical card possession and is designed for on-premises or badge-access scenarios, making it incompatible with the ubiquitous access requirement of a SaaS deployment.