Field Notes · Sheet 08 / 30 · Conditional Access and MFA
MFA methods by phishing resistance
Which MFA methods a phishing proxy can relay and which it can't, the three built-in authentication strengths, and where to require them first.
Bradley Baker · · 1 min read
A text message code and a passkey both count as MFA. Only one of them survives an adversary-in-the-middle phishing page. This is the longer version of Sheet 08: why the difference exists, how Entra lets you require the stronger methods, and where I'd start.
Why the timing matters
Passkeys became the Entra ID default on September 1, 2026. Microsoft's own SMS and voice MFA retires on February 1, 2027, and Global Administrators and external users follow on July 1, 2027.
Bound to the site, or not
The difference is whether the credential is bound to the site you're signing in to. A code from SMS, a voice call, or an authenticator app can be typed into a fake page and relayed to the real one in real time. A passkey or security key signs a challenge tied to the real site, so a proxy page gets nothing it can replay.
Three built-in authentication strengths
Entra lets you require the stronger methods with authentication strengths in Conditional Access. There are three built in:
| Strength | What satisfies it |
|---|---|
| Multifactor authentication | Anything that satisfies "require multifactor authentication." |
| Passwordless MFA | MFA without a password, which includes phone sign-in with Microsoft Authenticator. |
| Phishing-resistant MFA | FIDO2 security keys, Windows Hello for Business or platform credential, and multifactor certificate-based authentication. |
Device-bound and synced passkeys
Synced passkeys are generally available now too. Microsoft's guidance is device-bound passkeys, such as security keys or passkeys in Microsoft Authenticator, for admins and highly privileged users, and synced passkeys for everyone else. A custom authentication strength can allow only specific passkeys.
Where to start
I configured and administered passwordless methods in a 4,300-user tenant. The order I'd recommend: require phishing-resistant strength for admins first, where the user count is small and the stakes are highest, then widen.
What's standing between your admins and phishing-resistant MFA today?
Sources
- Conditional Access authentication strengthslearn.microsoft.com
- Enable passkeys (FIDO2) for your organizationlearn.microsoft.com
- MFA
- Passkeys
- FIDO2
- Authentication strengths
- Conditional Access