Phishing-resistant MFA is multifactor authentication that cannot be relayed or replayed by a fake sign-in page, because the credential is cryptographically bound to the real website and to a device the user holds. In Microsoft Entra ID, the methods that qualify are passkeys (FIDO2), Windows Hello for Business and certificate-based authentication. SMS codes, voice calls and push approvals are not phishing-resistant, and Microsoft has started retiring its own SMS and voice delivery for Entra ID sign-ins, so most organizations now need a passkey plan.
Key Takeaways
- Attackers now routinely bypass SMS codes and push approvals with adversary-in-the-middle phishing kits.
- Passkeys, Windows Hello for Business and certificate-based authentication are the phishing-resistant options in Entra ID.
- From September 1, 2026, passkeys became the default experience for users who rely on SMS or voice MFA.
- Microsoft-provided SMS and voice MFA is retired on February 1, 2027 for most users, and on July 1, 2027 for Global Administrators and external users.
- Roll out in phases: admins first, then high-risk roles, then everyone, enforced with Conditional Access authentication strengths.
Why Traditional MFA Is No Longer Enough
Any MFA is far better than a password alone. But the methods most organizations adopted first, such as text message codes, phone calls and “approve this sign-in” push notifications, share one weakness: the user can be tricked into handing the result to an attacker.
Modern phishing kits sit between the user and the real Microsoft sign-in page. The user enters a password and an MFA code on a convincing fake page, the kit passes both to Microsoft in real time, and the attacker walks away with a valid session cookie. Push fatigue attacks work in a similar way, by sending repeated approval prompts until someone taps “Approve”. These attacks are a common starting point for business email compromise and payment fraud.
Phishing-resistant methods stop this because the browser and authenticator check the website’s real domain before signing anything. A look-alike domain simply gets no usable response.
Which Methods Are Phishing-Resistant in Entra ID?
| Method | Phishing-resistant? | Best for |
|---|---|---|
| Passkeys in Microsoft Authenticator (device-bound) | Yes | Most users with a managed or personal smartphone |
| FIDO2 security keys | Yes | Admins, shared devices, users without phones |
| Windows Hello for Business | Yes | Users on managed Windows devices |
| Certificate-based authentication (smart cards) | Yes | Regulated and government-aligned environments |
| Microsoft Authenticator push with number matching | No | Interim step while passkeys roll out |
| SMS and voice codes | No | Being retired as Microsoft-provided methods |
Many organizations combine Windows Hello for Business on laptops with a passkey in Microsoft Authenticator as the portable, cross-device method, and keep FIDO2 security keys for administrators and break-glass scenarios.
What Microsoft’s SMS and Voice Retirement Means for You
Microsoft has published a retirement timeline for its own telephony delivery of SMS and voice authentication in Entra ID:
- September 1, 2026: Passkeys became the default authentication experience and were automatically enabled for users who use SMS or voice. These users are prompted to register a passkey at their next MFA sign-in.
- October 30, 2026: Organizations that must keep SMS or voice for regulatory or operational reasons can start configuring a third-party telephony provider through Microsoft Security Store.
- February 1, 2027: Microsoft-provided SMS and voice delivery is retired for all users except Global Administrators and external users.
- July 1, 2027: The same retirement applies to Global Administrators and external users.
A temporary opt-out exists for the September 2026 to February 2027 changes, but there is no opt-out from the retirement itself. After the retirement date, users whose only method is SMS or voice must register a passkey before they can continue signing in. Users who already use passkeys, Windows Hello for Business or another phishing-resistant method are not affected. Check the current Microsoft Learn guidance for your tenant before you plan dates, because details can change.
This is separate from Microsoft’s mandatory MFA requirement for Azure, which already requires MFA for administrative sign-ins to the Azure portal, Microsoft Entra admin center and Intune admin center, and is extending to Azure CLI, PowerShell and infrastructure-as-code tools.
A 6-Step Passkey Rollout Plan
- Find out where you are. Use the authentication methods activity report in Entra ID to see how many users rely on SMS, voice or push only, and which accounts have no MFA method at all.
- Enable the right methods. In the Authentication methods policy, enable Passkey (FIDO2) and decide whether to allow passkeys in Microsoft Authenticator, security keys or both. Enforce attestation for security keys if you need to restrict models.
- Protect administrators first. Require phishing-resistant MFA for all privileged roles using a Conditional Access policy with the built-in “Phishing-resistant MFA” authentication strength. Pair this with privileged identity management so admin rights are only active when needed.
- Extend to high-risk users. Finance, HR, executives and IT support staff are the most targeted. Move them next and include them in fraud-awareness training.
- Roll out to everyone. Run registration campaigns, give clear instructions for new phones and lost devices, and make Temporary Access Pass the standard way to bootstrap a new passkey.
- Enforce and clean up. Apply authentication strengths broadly through Conditional Access policies, then disable SMS and voice where they are no longer needed and review exceptions regularly.
Common Pitfalls to Avoid
- Locking out break-glass accounts. Keep at least two emergency access accounts protected with FIDO2 keys stored securely, and exclude them carefully from policies that could block them.
- Ignoring account recovery. Attackers target help desks. Require identity verification before resetting MFA, and issue Temporary Access Passes instead of re-enabling SMS.
- Forgetting guests and service desks. Plan how external users, shared mailboxes and frontline workers will authenticate.
- Treating MFA as the whole strategy. Phishing-resistant MFA is one pillar of a Zero Trust architecture. Device compliance, token protection and continuous monitoring still matter.
How Skytech Enterprise Helps
Our Conditional Access and MFA service designs and rolls out passkeys, Windows Hello for Business and authentication strengths with minimal disruption. We combine it with Entra ID security hardening for organizations across the USA and UAE. Book an identity security review.
Frequently Asked Questions
What is phishing-resistant MFA?
It is multifactor authentication that binds the credential to the genuine website and the user’s device, so a fake sign-in page cannot capture and reuse it. Passkeys, FIDO2 security keys, Windows Hello for Business and certificate-based authentication qualify.
Is Microsoft Authenticator push phishing-resistant?
No. Push notifications with number matching are stronger than SMS, but a user can still approve a sign-in started by an attacker. A passkey stored in Microsoft Authenticator is phishing-resistant.
Is Microsoft getting rid of SMS MFA?
Microsoft is retiring its own SMS and voice delivery for Entra ID authentication. It ends on February 1, 2027 for most users and on July 1, 2027 for Global Administrators and external users. Organizations that still need SMS can use a supported third-party telephony provider.
What is the difference between a passkey and a FIDO2 security key?
A FIDO2 security key is a physical device such as a USB or NFC key. A passkey is the FIDO2 credential itself, which can live on a security key, in Microsoft Authenticator on a phone, or in Windows Hello.
Which license do I need for phishing-resistant MFA?
Passkeys and security keys are available in all Entra ID editions. Enforcing them with Conditional Access authentication strengths requires Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5.
How long does a passkey rollout take?
Administrators can usually be moved within a few weeks. A full rollout for a mid-size organization typically takes one to three months, depending on device readiness, communication and support capacity.