Multi-factor authentication stops most account takeover, but not all of it. Attackers now use phishing kits that capture both your password and your one-time code, and “MFA fatigue” attacks that bombard staff with prompts until someone taps approve. The answer is phishing-resistant MFA. This guide explains what it is and how to set it up for new Microsoft 365 users from day one.
Why phishing is such a serious threat
Phishing remains the most common way attackers get into business accounts. A convincing fake sign-in page can trick a busy employee in seconds. Standard MFA methods such as SMS codes, voice calls, authenticator app codes and simple push approvals can all be relayed by an attacker sitting in the middle of the sign-in, which is known as adversary-in-the-middle phishing.
What is phishing-resistant MFA?
Phishing-resistant methods are cryptographically bound to the genuine website. If a user lands on a fake page, the method simply does not work, so there is nothing to hand over. The main options in Microsoft 365 are:
- Passkeys, including passkeys in Microsoft Authenticator and on a phone.
- FIDO2 security keys, small physical keys that you plug in or tap.
- Windows Hello for Business, which uses a PIN or biometrics tied to the device.
- Certificate-based authentication, used in more advanced environments.
The new-user problem
New starters are a weak point because they have no MFA method yet. If you let them register with only a password, you create a window where an attacker who has the password can register their own method first. The fix is to give new users a secure way to prove who they are and register a strong method straight away.
How to onboard new users securely
- Issue a Temporary Access Pass. This is a time-limited passcode created by an administrator. It lets the new user sign in and register a passkey without ever needing a password, and it expires quickly.
- Register a phishing-resistant method. Have the user create a passkey or Windows Hello credential during their first sign-in, ideally with IT or a manager present or on a verified video call.
- Add a backup method. Register a second method, such as a second passkey or a security key, so a lost phone does not lock them out.
- Enforce it with Conditional Access. Use an authentication strength policy that requires phishing-resistant methods for administrators and sensitive apps, and require MFA for everyone else.
Tips for a smooth rollout
- Start with administrators and finance staff, then widen.
- Give staff a short, plain-English guide and a clear person to ask for help.
- Use number matching and additional context for any push approvals you keep during the transition.
- Remove SMS and voice methods once most users have moved across.
Conclusion
Key takeaways
- Standard MFA methods such as SMS codes, voice calls, authenticator app codes and simple push approvals can be relayed by an attacker in the middle of the sign-in.
- Phishing-resistant methods are cryptographically bound to the genuine website, so they fail on a fake page.
- The main options in Microsoft 365 are passkeys, FIDO2 security keys, Windows Hello for Business and certificate-based authentication.
- New starters are a weak point because they have no MFA method yet, so onboarding is the best moment to get it right.
Phishing-resistant MFA: frequently asked questions
What is phishing-resistant MFA?
Phishing-resistant methods are cryptographically bound to the genuine website. If a user lands on a fake sign-in page, the method simply does not work, so there is nothing to hand over to the attacker.
Why can ordinary MFA still be phished?
Attackers use phishing kits that capture both a password and a one-time code, and MFA fatigue attacks that bombard staff with prompts until someone taps approve. SMS codes, voice calls, authenticator codes and simple push approvals can all be relayed by an attacker in the middle of the sign-in.
Which phishing-resistant methods are available in Microsoft 365?
Passkeys, including passkeys in Microsoft Authenticator and on a phone, FIDO2 security keys, Windows Hello for Business, and certificate-based authentication for more advanced environments.
Related reading: Microsoft Entra ID consulting. For Microsoft or government guidance, see Microsoft guidance on passkeys and FIDO2.
Phishing-resistant MFA closes the gap that ordinary MFA leaves open, and onboarding is the best moment to get it right. Total Solutions IT can design and roll out secure sign-in for your team. Call 02 6061 4222 to find out more.
