What counts as phishing-resistant MFA in Microsoft 365?

Key facts

• Phishing resistance comes from a cryptographic key bound to the real sign-in domain.
• Authenticator push with number matching is stronger than SMS but can still be phished.
• Conditional Access has a built-in phishing-resistant MFA authentication strength.
• Microsoft is moving tenants toward passkeys as the default sign-in experience.
• Admins and finance staff should be first in line for phishing-resistant methods.

Why ordinary MFA can still be phished

Adversary-in-the-middle phishing kits sit between the user and the real Microsoft sign-in page. The user types a password and approves a push or enters a code, and the kit captures the session cookie. The attacker is then signed in, MFA and all.

Phishing-resistant methods stop this because the credential is a private key that only answers challenges from the genuine sign-in domain. A look-alike domain gets nothing it can use. That is the core test: if the method relies on a person typing or approving something a fake site can relay, it is not phishing-resistant.

The phishing-resistant methods Microsoft supports

Microsoft Entra ID supports several methods that meet the bar. Most organizations use a mix, matched to devices and roles.

Methods that are MFA but not phishing-resistant

These still beat a password alone, and they remain useful as a bridge, but they should not be the end state for privileged or high-risk users.

• Microsoft Authenticator push notifications, even with number matching.
• Authenticator or third-party app one-time codes.
• SMS and voice call codes, which are also exposed to SIM swap.
• Email one-time passcodes.
• Temporary Access Pass, which is a short-lived onboarding and recovery credential, not a daily method.

Enforcing it with authentication strengths

Conditional Access authentication strengths let you say which methods are acceptable for a given app or user. The built-in phishing-resistant MFA strength allows only the methods above. You can also build a custom strength, for example to allow only specific FIDO2 key models.

Start with a policy for directory roles, then add finance, HR and executives, then any user accessing sensitive apps. Run each policy in report-only mode first and check the sign-in logs for users who would be blocked because they have not registered a qualifying method.

Rolling it out without lockouts

Registration has to come before enforcement. Use Temporary Access Pass to let users register a passkey or security key on day one, and use a registration campaign to nudge Authenticator users toward passkeys. Plan for edge cases: shared devices, users who travel without a phone, older Windows hardware without a usable TPM, and apps that open embedded browsers.

Recovery matters as much as sign-in. Encourage at least two qualifying methods per user, such as Windows Hello plus a passkey on the phone, so a lost device does not mean a help desk escalation.

How Accred Consulting approaches it

Accred Consulting moves organizations to phishing-resistant MFA in phases. Discovery checks devices, licensing, current methods and which users carry the most risk. The proposal sets a clear scope, fixed price and timeline. US-based specialists configure the authentication methods policy, passkeys and Windows Hello for Business, set up authentication strengths in Conditional Access starting with admins, and build the Temporary Access Pass and recovery process for the help desk. Handover includes documentation and knowledge transfer so your team can extend it to new groups.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions