Phishing-resistant MFA and passkeys in Microsoft 365

Many Microsoft 365 account takeovers today don't involve a guessed password at all. They start with an email linking to a sign-in page that looks exactly like Microsoft's. Behind it sits an adversary-in-the-middle proxy: the victim types their password and approves the MFA prompt, the proxy passes both to the real Microsoft service, and the attacker keeps the session token that comes back. MFA happened. It just happened for the attacker.

The US National Institute of Standards and Technology explains why in its digital identity guidelines (NIST SP 800-63B). Any method where the person reads or approves something and the result is typed or relayed can't tell a real site from a fake one. Passwords, one-time codes from an app or text message, and out-of-band approvals are all listed as not phishing-resistant. Phishing resistance comes from cryptographic authenticators that bind the sign-in to the real website's address, so a fake site simply gets nothing usable.

Microsoft's built-in Phishing-resistant MFA authentication strength accepts these methods:

• Synced passkeys (stored in a password manager or platform keychain) can also be allowed through Entra passkey profiles. They are easier to recover but leave your control when they sync to a personal account, so many organizations allow them for general staff and require device-bound keys for admins.
• The Canadian Centre for Cyber Security's baseline controls for small and medium organizations call for two-factor authentication wherever possible, and specifically for administrator, financial and cloud accounts. Phishing-resistant methods are the strongest way to meet that.

1. 01

   Global and privileged administrators

   One stolen admin session can undo every other control. Microsoft's own Conditional Access deployment plan lists phishing-resistant methods for privileged roles as a foundation policy.

2. 02

   Emergency access accounts

   Microsoft recommends FIDO2 passkeys for break-glass accounts, using a different method from day-to-day admin accounts.

3. 03

   People who move money or approve payments

   Accounts payable, controllers and executives are the targets of business email compromise and payment redirection fraud.

4. 04

   People with access to sensitive client data

   Lawyers, HR, clinicians, wealth advisors: anyone whose mailbox would trigger a breach notification if read.

5. 05

   Everyone else

   Once the process and support are proven, extend it. Authenticator passkeys and Windows Hello keep the cost low for general staff.

Enforcement happens through Conditional Access (Entra ID P1 or higher). Instead of the generic Require multifactor authentication control, choose Require authentication strength and pick the built-in Phishing-resistant MFA strength, or build a custom strength that lists exactly which methods count. Microsoft notes you can't use Require MFA and Require authentication strength in the same policy.

Target the policy at directory roles or a security group, start in report-only, and confirm every targeted user has registered a qualifying method before you switch it on. Users who sign in with a password and then hit a phishing-resistant requirement are prompted to use a qualifying method; with Windows Hello they may need to choose a different sign-in option.

• Enable the Passkey (FIDO2) method in the Entra authentication methods policy and create passkey profiles per group: for example, device-bound with attestation enforced for admins, and device-bound or synced for general staff.
• Issue two keys per admin: one carried, one locked away. A lost key is a support call, not a lockout.
• Write the recovery process before launch. Who verifies identity when someone loses everything, and how? A recovery process that accepts a phone call and a birthday turns your strongest control into your weakest.
• Use Temporary Access Pass (a time-limited code issued by an admin) for onboarding and recovery rather than falling back to SMS.
• Remove weaker methods for the protected group once they're enrolled, otherwise attackers simply choose the weaker method.

Track three numbers monthly: the share of privileged accounts with a phishing-resistant method registered, the share of their sign-ins actually using it, and the count of exceptions. The Entra authentication methods activity reports show registration and usage by method. Report-only results on the authentication strength policy show who would fail today.

Sources: Microsoft Learn, 'Conditional Access authentication strengths' and 'Enable passkeys (FIDO2) for your organization'; NIST SP 800-63B (Rev. 4), section 3.2.5 on phishing resistance; Canadian Centre for Cyber Security, 'Baseline cyber security controls for small and medium organizations', control BC.5.1.