Users currently access SaaS email with five-character passwords that use only letters and numbers. An administrator needs to make access more secure without changing the password policy. Which of the

Changing the email service provider does not inherently improve authentication security and introduces significant migration cost and complexity.

MFA with a one-time password adds a second authentication factor - something the user has (the OTP token or app) - without requiring any change to the existing password length or complexity policy. OTP-based MFA is available in many SaaS platforms at little to no additional cost, making it the lowest-cost option that directly satisfies both requirements.

SSO consolidates authentication across services but does not add an additional security factor, and implementing SSO infrastructure incurs higher cost than enabling MFA.

Certificate-based authentication requires a Public Key Infrastructure (PKI) for issuing and managing certificates, which carries substantially higher implementation and operational costs than OTP-based MFA.