Phishing-resistant MFA: what actually counts

Sample post. Replace it with your own, or set draft: true to hide it.

Why “MFA” isn’t the finish line

Push approvals, SMS and one-time codes all add a second factor, but none of them is bound to the site you’re signing in to. An adversary-in-the-middle proxy relays the code or the approval and walks away with the session.

If a user can be tricked into completing the ceremony on the wrong site, the method isn’t phishing-resistant.

Methods that are

Method	Why it resists phishing
FIDO2 security keys and passkeys	Credential is scoped to the relying party’s origin
Windows Hello for Business	Key bound to the device and the IdP
Certificate-based authentication	Private key never leaves the user’s device or smart card

Enforcing it

In Conditional Access, use the built-in Phishing-resistant MFA authentication strength rather than “Require multifactor authentication”. Start with privileged roles:

Users:          Directory roles -> Global Administrator, Privileged Role Administrator, ...
Target:         All resources
Grant:          Require authentication strength -> Phishing-resistant MFA

Make sure your break-glass accounts have a path that matches the policy before you switch it on.