In-band authentication is when the user presents credentials directly into the application. IBM Z MFA Out-of-Band authentication allows a user to authenticate outside of the z/OS authentication process with one or more factors to retrieve a cache token credential.