Use Microsoft Entra Conditional Access to require a phishing-resistant authentication strength, starting with privileged administrators. First make sure those administrators have registered supported methods; then test the policy in report-only mode before enforcing it. Expand to other users only after enrollment, recovery, guest access, and automation have been considered.
What phishing-resistant MFA means in Microsoft Entra
Multifactor authentication (MFA) asks a user to prove their identity with more than one factor. Phishing-resistant MFA uses methods designed to resist attackers who trick users into entering credentials on a fake sign-in page. In Microsoft Entra, Conditional Access uses an authentication strength to specify which combinations of methods are acceptable for an access attempt.
The built-in phishing-resistant strength includes FIDO2 security keys and Windows Hello for Business or platform credentials. Microsoft’s passwordless deployment guidance also discusses passkeys and certificate-based authentication; do not assume every method is available on every device or accepted by the built-in strength in every configuration. Check the current authentication-strength combinations and test them with the tenant, devices, and users you intend to cover. Microsoft notes that the built-in strength is fixed but may change as methods are added.
A Conditional Access requirement does not necessarily stop a user from entering a password at the start of sign-in. Microsoft says authentication strength is evaluated after initial authentication: a user might enter a password, then have to satisfy the required phishing-resistant method before proceeding.
Recommended Free Tools
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose methods users can actually use
| Method | What to assess | Evidence-based qualification |
|---|---|---|
| FIDO2 security key | Whether the user can keep and use a physical key, and whether their endpoints and sign-in flows support it. | Microsoft lists FIDO2 security keys in the built-in phishing-resistant strength. The cited guidance does not validate a particular brand or model. |
| Windows Hello for Business or platform credential | Whether the relevant devices and user environment support the credential and whether it is provisioned before enforcement. | Microsoft lists Windows Hello for Business or platform credentials among the built-in strength’s combinations; verify current tenant and platform support. |
| Passkeys | Which passkey type and devices your users will use, and whether it fits your tenant’s method and policy configuration. | Microsoft’s passwordless deployment guide discusses passkeys. Confirm their current availability and acceptance in the intended policy. |
| Certificate-based authentication | Certificate issuance, device and user compatibility, and the operational work needed to manage credentials. | Microsoft’s passwordless deployment guide discusses certificate-based authentication. The supplied guidance does not establish that every certificate configuration satisfies the built-in strength. |
If selecting a physical option, treat “FIDO2 security key” as a method category, not a recommendation for a particular product. Verify the organization’s authentication-method policy and endpoint support before buying or distributing keys.
Inventory identities and dependencies before rollout
Map who and what could be affected before creating enforcement policies. Include privileged built-in directory roles, regular Microsoft 365 users, guests, emergency access accounts, service accounts, service principals, legacy clients, and the devices and platforms people use. Record which methods are enabled and which users have registered them.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Identify the administrators and built-in roles that need early protection.
- Find users who have not registered an acceptable method, including administrators, before assigning them an enforced policy.
- Document the organization’s emergency access accounts and how those accounts will be protected and recovered.
- Identify user-based scripts or integrations that may rely on a service account, plus service-principal automation that a user policy will not cover.
- Determine how guest users authenticate and whether the resource tenant trusts MFA performed in a home tenant.
- Check whether legacy clients or device diversity create sign-in paths that need separate testing.
Require phishing-resistant MFA for administrators first
Microsoft’s administrator guidance describes a focused Conditional Access policy that targets recommended privileged built-in directory roles, applies to all resources, and requires the built-in phishing-resistant authentication strength. The guidance cautions that Conditional Access policies support built-in roles; custom roles and roles scoped to administrative units are not enforced in the same way in this policy guidance.
Register methods before applying the requirement
Have affected administrators register the intended methods before enforcement. Microsoft warns that enabling a policy requiring phishing-resistant MFA before administrators register appropriate methods risks locking administrators out of the tenant. Confirm that each targeted administrator can complete the required sign-in and that an approved recovery path exists.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use report-only mode to check impact
- Create the administrator policy with the intended built-in role targeting, all-resource scope, phishing-resistant authentication strength, and documented emergency-access exclusions.
- Set the policy to Report-only rather than turning it on immediately.
- Review the policy’s reported impact and investigate results that indicate a targeted administrator would be blocked or unable to satisfy the requirement.
- Resolve enrollment, compatibility, or scope issues; verify administrator sign-in and recovery paths.
- When the results are understood and the required methods are registered, change the policy from report-only to On.
Report-only mode is a validation step, not a substitute for enrollment or a recovery plan. Keep emergency access exclusions limited, controlled, and consistent with the organization’s documented recovery design.
Expand from administrators to the wider workforce
After the privileged rollout is operating as intended, plan broader coverage as an organization-wide change rather than simply widening the first policy. Microsoft recommends a baseline Conditional Access policy requiring MFA for all users and resources. Moving from general MFA to a phishing-resistant requirement entails a stronger method requirement and therefore needs method enrollment and operational preparation.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Group users by readiness, device and platform support, and sign-in dependencies.
- Communicate which methods users can register and how they will obtain help if enrollment or sign-in fails.
- Enable the intended methods in the authentication-method policy and allow users to register before their enforcement date.
- Test the proposed Conditional Access scope in report-only mode, review its impact, and resolve unexpected results.
- Enforce in controlled stages, with help-desk coverage, monitoring, and a process for reviewing exceptions.
Microsoft’s guidance does not prescribe a universal rollout timetable. Set the pace according to enrollment readiness and the organization’s ability to support users and recover access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Handle guests, emergency access, and automation separately
Guest users
External users may satisfy MFA in their home tenant or in the resource tenant, depending on the cross-tenant configuration and sign-in arrangement. Microsoft’s guidance also identifies limitations for external authentication methods with authentication-strength controls. Check which methods the resource tenant accepts and whether home-tenant MFA is trusted before applying a requirement to guests; do not assume the administrator policy’s behavior automatically covers them.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Emergency access accounts
Exclude organization-controlled emergency access accounts from the administrator policy according to a documented recovery design. Define who controls them, how they are secured and monitored, and how access would be restored if ordinary administrator methods or devices were unavailable. The exclusion is a deliberate recovery measure, not a general exception for administrators who have not enrolled.
Service accounts and service principals
A user-scoped Conditional Access policy does not target service principals. Inventory automation that authenticates as a user and evaluate whether it can move to managed identities or another appropriate workload identity. Assess service-principal protections with workload identity controls rather than assuming a user MFA policy will protect those calls.
Check licensing and neighboring security controls
Microsoft’s phishing-resistant passwordless deployment guide says registration and passwordless sign-in do not require a license, but recommends at least Microsoft Entra ID P1 for full deployment capabilities such as Conditional Access enforcement and authentication-method activity reporting. Verify the tenant’s current SKU and feature entitlements before rollout because licensing and feature packaging can change.
Phishing-resistant MFA addresses an important identity risk, but it does not by itself establish that a device is compliant or eliminate every account or session risk. Consider device compliance, token protection, and access reviews as separate controls suited to the organization’s needs. Maintain monitoring and recovery procedures alongside the authentication policy.
Microsoft’s separate all-user MFA guidance attributes a broad claim that MFA makes an account “more than 99.9% less likely to be compromised” to Alex Weinert, Director of Identity Security at Microsoft. The cited page does not state the underlying study, sample, or publication year; the claim concerns MFA generally, not the incremental effect of phishing-resistant MFA.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
