Phishing-Resistant MFA in Microsoft Entra ID: Rolling Out Passkeys to Thousands of Users

Phishing-resistant MFA in Microsoft Entra ID means signing in with a passkey, Windows Hello for Business or certificate-based authentication, methods bound to the site the user signs in to, so a fake login page captures nothing it can replay. Entra ID enforces them through the built-in phishing-resistant MFA authentication strength in Conditional Access. For a large workforce, the hard part is registration: getting thousands of people enrolled without a help desk queue, which a wave plan with Temporary Access Pass handles well.

What makes MFA phishing-resistant

MFA is phishing-resistant when the credential is cryptographically bound to the real site and cannot be relayed through a fake one. Passkeys and Windows Hello for Business use public key cryptography tied to the site's domain, so a sign-in on a lookalike domain fails. SMS codes, voice calls, one-time passcodes and push approvals can all be passed through an adversary-in-the-middle proxy, and phishing kits built on those proxies capture both the password and the code.

CISA's fact sheet on implementing phishing-resistant MFA names FIDO2/WebAuthn and PKI-based authentication as the phishing-resistant forms. Number matching in Microsoft Authenticator push reduces MFA fatigue attacks, and it still counts as phishable.

Phishing-resistant methods available in Microsoft Entra ID

Entra ID supports several phishing-resistant methods, and most organizations use more than one. The table compares them.

The passkey (FIDO2) settings in the authentication methods policy decide which passkey types are allowed, including whether only specific authenticator models (by AAGUID) are accepted. Administrators usually get a stricter profile, such as hardware keys only, and the wider workforce gets device-bound or synced passkeys.

Authentication strengths turn MFA into a Conditional Access requirement

Authentication strengths let a Conditional Access policy require specific methods instead of any MFA. Entra ID includes three built-in strengths: MFA strength, passwordless MFA strength and phishing-resistant MFA strength. Custom strengths can restrict further, for example to FIDO2 keys from one vendor for administrators.

A typical policy set for the rollout:

1. Administrators: phishing-resistant MFA strength for every directory role, enforced first.
2. Sensitive applications: phishing-resistant MFA strength for finance, HR and production access.
3. Everyone: MFA strength during registration waves, switched to phishing-resistant MFA strength once a wave is enrolled.
4. Registration of security info: require a Temporary Access Pass or a trusted location, so an attacker with a stolen password cannot register their own method.

Every new policy starts in report-only mode for at least a week. The sign-in logs then show which users and applications would fail, before anyone is blocked. Two emergency access accounts stay excluded from these policies, with their own strong credentials and sign-in alerts.

Temporary Access Pass and registration campaigns for large rollouts

A Temporary Access Pass is a time-limited passcode an administrator or a lifecycle workflow issues so a user can sign in once and register a passkey. It removes the need to set up a weaker method first, and it is the standard way to onboard new hires straight to phishing-resistant MFA. With HR-driven provisioning, a lifecycle workflow can generate the pass before the start date and send it to the manager, as the guide to HR-driven provisioning in Entra ID describes.

Registration campaigns prompt existing users to register a passkey at sign-in, with a limited number of snoozes. Microsoft updated the passkey registration experience through 2026 so campaigns and the My Sign-Ins page steer users toward the passkey types the policy allows, according to Message Center notice MC1440968.

For a workforce of several thousand people, the registration plan decides how the rollout goes. The elements that keep help desk volume down:

• Waves of 500 to 1,000 users by department or site, each with a start date and a target date for enforcement.
• Communications two weeks ahead, with a short video or one-page guide for each method.
• Walk-up support at each site during the first days of each wave.
• Recovery path: a documented process for lost phones and keys, using identity verification and a new Temporary Access Pass.
• Tracking: the authentication methods registration report, reviewed daily during a wave.

Rollout order for a passkey migration in Entra ID

1. Emergency access accounts and administrators. Hardware keys or device-bound passkeys, enforced through Privileged Identity Management and a custom authentication strength. The privileged access management service covers the wider administrator design.
2. IT and the help desk. They support everyone else, so they should know each method first-hand.
3. High-risk roles. Finance, HR, executives and their assistants, and anyone with access to production systems.
4. The wider workforce in waves. Windows Hello for Business on Entra-joined devices for daily sign-in, plus a passkey in Microsoft Authenticator for other devices.
5. Remove phishable methods. Once a population is enrolled, disable SMS and voice for it in the authentication methods policy and require the phishing-resistant strength.

Frontline workers on shared devices, contractors without managed devices and staff who decline to use a personal phone need a defined answer before their wave. Hardware security keys are the usual one.

How phishing-resistant MFA supports SOC 2 and ISO 27001

Phishing-resistant MFA gives auditors a clear, testable authentication control. ISO 27001 A.8.5 covers secure authentication, described in the ISO 27001 A.8.5 guide, and A.5.17 covers authentication information, described in the A.5.17 guide. SOC 2 CC6.1 covers logical access security, described in the SOC 2 CC6.1 guide.

The evidence is the Conditional Access policy set, the authentication strength definitions, the registration report showing coverage, and sign-in logs showing the phishing-resistant method on sampled sign-ins. Forwarding sign-in logs to the central log store keeps them for the full audit period.

Practical steps to start a phishing-resistant MFA rollout in Entra ID

1. Pull the authentication methods registration report to see which methods users have today.
2. Set the authentication methods policy for passkeys, including allowed types per group.
3. Create the emergency access accounts and exclude them from the new policies.
4. Enforce phishing-resistant MFA for administrators with a custom authentication strength.
5. Protect security info registration with Temporary Access Pass or trusted locations.
6. Plan the waves, communications and walk-up support for the wider workforce.
7. Run each policy in report-only mode, then enforce wave by wave and remove SMS and voice.

Organizations moving off on-premises Active Directory at the same time can align the waves with device migration, as the Active Directory to Entra ID migration guide describes.

Phishing-resistant MFA in Entra ID succeeds through registration planning

Microsoft Entra ID has every piece needed for phishing-resistant MFA: passkeys, Windows Hello for Business, authentication strengths and Temporary Access Pass. Organizations that enforce it for administrators first, register the workforce in waves and switch each wave to the phishing-resistant strength once it is enrolled reach full coverage without a spike in help desk calls.

Rolling out passkeys or phishing-resistant MFA across your organization? Truvo's identity architects design the Conditional Access policies and authentication strengths, plan the registration waves and support the rollout through enforcement. See Microsoft Entra ID consulting or book a strategy call.

Frequently asked questions

What counts as phishing-resistant MFA in Microsoft Entra ID?

Passkeys (FIDO2), including passkeys in Microsoft Authenticator, on security keys and synced passkeys where allowed, Windows Hello for Business, Platform SSO on macOS and certificate-based authentication. These methods are included in the built-in phishing-resistant MFA authentication strength in Conditional Access.

Is Microsoft Authenticator push with number matching phishing-resistant?

Push approval with number matching reduces MFA fatigue attacks, and it can still be relayed through an adversary-in-the-middle proxy. A passkey stored in Microsoft Authenticator is phishing-resistant, since it is bound to the sign-in domain.

How do new hires register a passkey on their first day?

An administrator or a lifecycle workflow issues a Temporary Access Pass before the start date. The new hire signs in with it on the first day and registers a passkey or sets up Windows Hello for Business, with no password or SMS step.

What happens when a user loses the phone that holds their passkey?

The help desk verifies the user's identity through a documented process, removes the lost method and issues a new Temporary Access Pass so the user can register a new passkey. Users with a second registered method, such as a security key or Windows Hello for Business, can sign in with it in the meantime.

Should synced passkeys be allowed?

Synced passkeys in iCloud Keychain or Google Password Manager are phishing-resistant and simplify recovery, since the key follows the user to a new device. Many organizations allow them for the general workforce and require device-bound passkeys or hardware keys for administrators.

Sources

• Microsoft Learn, Passkeys (FIDO2) authentication method in Microsoft Entra ID
• Microsoft Learn, Conditional Access authentication strengths
• Microsoft Learn, Temporary Access Pass
• Microsoft Learn, Plan a phishing-resistant passwordless authentication deployment
• CISA, Implementing Phishing-Resistant MFA (fact sheet, October 2022)
• Microsoft 365 Message Center MC1440968, Optimizations for passkey registration experience (2026)