Phishing-Resistant MFA: Moving Your Team to Passkeys and Security Keys

Passwords alone are no longer enough to protect business accounts. Even traditional multi-factor authentication (MFA), while significantly better than passwords by themselves, is increasingly being targeted by sophisticated phishing campaigns, token theft, and social engineering attacks.

Cybercriminals have evolved beyond simply stealing passwords. Today, they often trick users into approving MFA requests, capture authentication tokens through adversary-in-the-middle (AiTM) phishing, or abuse legitimate authentication processes such as device code flow.

To combat these modern attacks, organisations are increasingly adopting phishing-resistant multi-factor authentication (MFA) using passkeys and FIDO2 security keys.

Unlike passwords, SMS codes, or one-time passcodes, phishing-resistant authentication uses public-key cryptography that is bound to the legitimate website or service. This makes it significantly more difficult for attackers to steal reusable credentials or trick users into authenticating to fake websites.

Microsoft, CISA, NIST and many cyber insurance providers now recommend phishing-resistant MFA for privileged accounts and, wherever practical, for all users. Microsoft identifies passkeys and FIDO2 security keys as phishing-resistant authentication methods supported by Microsoft Entra ID. (learn.microsoft.com⁠)

This guide explains what phishing-resistant MFA is, why it matters, how passkeys and security keys work, and how businesses can successfully migrate from traditional MFA methods.

What Is Phishing-Resistant MFA?

Phishing-resistant MFA is authentication that is specifically designed to prevent users from unknowingly providing valid authentication credentials to fake websites or attackers.

Instead of relying on:

• Passwords
• SMS codes
• Authentication app codes
• Push notifications
• Telephone verification

phishing-resistant authentication uses cryptographic keys that only work with the legitimate website or application.

If an employee accidentally visits a fake Microsoft login page, their security key or passkey simply refuses to authenticate because the website is not the real Microsoft domain.

This eliminates one of today’s biggest attack methods.

Why Traditional MFA Isn’t Always Enough

Traditional MFA dramatically improves security.

However, attackers have adapted.

Common attacks now include:

• MFA fatigue attacks
• Push bombing
• Device code phishing
• Adversary-in-the-middle phishing
• Session cookie theft
• OAuth consent attacks
• Token replay attacks

Rather than stealing passwords, attackers increasingly steal authenticated sessions or trick users into approving their own login attempts.

Microsoft’s security research continues to show attackers targeting authenticated sessions rather than simply attempting password theft. (microsoft.com⁠)

This means the strongest protection begins before the session is created.

What Makes Passkeys Different?

Passkeys replace reusable passwords with cryptographic key pairs.

Every passkey consists of:

• A private key stored securely on the user’s device
• A public key stored by the service

When the user signs in:

1. The website proves its identity.
2. The device verifies the website.
3. The device signs a cryptographic challenge.
4. The website verifies the response.

The private key never leaves the user’s device.

There is no password to steal.

There is no code to intercept.

There is nothing reusable for attackers to capture.

What Is a FIDO2 Security Key?

A FIDO2 security key is a physical authentication device.

It may connect through:

• USB-A
• USB-C
• NFC
• Bluetooth (less common)

Examples include:

• YubiKey
• Feitian
• Token2
• Kensington VeriMark
• Google Titan Security Key

Instead of typing passwords or approving push notifications, users simply:

• Insert the key
• Tap the key
• Enter a PIN (where required)
• Touch the sensor

Authentication completes in seconds.

Passkeys vs Security Keys

Although people often use the terms interchangeably, they are slightly different.

Both are phishing-resistant.

How Passkeys Prevent Phishing

Traditional phishing works because users willingly type passwords into fake websites.

Passkeys don’t.

Suppose an attacker creates:

https://micr0soft-login.example

instead of:

https://login.microsoftonline.com

The browser recognises the website is different.

The passkey refuses to authenticate.

The attacker receives nothing useful.

Why Public-Key Cryptography Matters

Passkeys rely on asymmetric cryptography.

Instead of one shared secret (a password), there are two mathematically related keys.

Private Key

       ↓

Never leaves device

Public Key

       ↓

Stored by Microsoft

Only the private key can complete authentication.

Stealing the public key provides no usable credential.

Why Businesses Should Move Now

Cyber threats continue to evolve.

Businesses increasingly face:

• Business Email Compromise (BEC)
• Ransomware
• Credential theft
• Token theft
• Supply-chain attacks
• Identity attacks

Many cyber insurance questionnaires now ask about phishing-resistant MFA rather than simply asking whether MFA is enabled.

Moving early reduces future migration pressure.

Microsoft Strongly Encourages Passkeys

Microsoft has invested heavily in passwordless authentication.

Supported methods include:

• Passkeys
• FIDO2 security keys
• Windows Hello for Business
• Certificate-based authentication

Microsoft recommends phishing-resistant authentication for privileged accounts wherever possible. (learn.microsoft.com⁠)

Which Users Should Move First?

Prioritise:

• Global Administrators
• Security Administrators
• Conditional Access Administrators
• Exchange Administrators
• Finance teams
• Payroll
• HR
• Executives
• IT support
• Helpdesk password reset staff

These users represent the highest-value targets.

Passkeys Improve User Experience

Security often fails when it becomes inconvenient.

Fortunately, passkeys usually improve both.

Instead of:

• remembering passwords
• typing passwords
• entering MFA codes
• approving push notifications

users simply:

• unlock their device
• touch a fingerprint reader
• use Face ID
• enter a PIN
• tap a security key

Authentication becomes faster.

Windows Hello for Business

Windows Hello for Business is Microsoft’s enterprise passwordless authentication solution.

Users authenticate using:

• Face recognition
• Fingerprint
• PIN

The underlying credential remains cryptographic rather than password-based.

Windows Hello integrates with Microsoft Entra ID and supports phishing-resistant authentication.

Using Authentication Strengths

Conditional Access now supports Authentication Strengths.

Instead of requiring:

MFA

you can require:

Phishing-resistant MFA

This allows administrators to specify acceptable authentication methods.

For example:

Require Authentication Strength

↓

Phishing-Resistant MFA

Users attempting SMS authentication would be denied.

Planning Your Migration

Avoid replacing every authentication method overnight.

Instead:

Phase 1

Inventory users.

Phase 2

Review authentication methods.

Phase 3

Enable passkeys for pilot users.

Phase 4

Train IT administrators.

Phase 5

Deploy to executives.

Phase 6

Deploy to finance.

Phase 7

Deploy to remaining users.

Review Existing Authentication Methods

Check:

• SMS
• Voice calls
• Microsoft Authenticator
• Passkeys
• FIDO2
• Windows Hello
• Temporary Access Pass

Remove unnecessary weak methods gradually.

Temporary Access Pass

Temporary Access Pass (TAP) helps users register new authentication methods.

Administrators issue a short-lived credential.

The user signs in once.

They register:

• Passkey
• FIDO2 key
• Windows Hello

Then TAP expires.

This greatly simplifies onboarding.

Security Keys Require Planning

Before purchasing security keys, consider:

• USB-A or USB-C?
• NFC required?
• Shared workstations?
• Remote workers?
• Backup keys?
• Replacement process?
• Storage?

Standardising hardware reduces support issues.

Create a Recovery Process

Users will:

• lose keys
• replace laptops
• change phones
• forget PINs

Document:

• identity verification
• replacement keys
• Temporary Access Pass issuance
• helpdesk approval
• recovery timelines

Recovery should remain secure.

Train Your Users

Explain:

• Why passwords are disappearing
• How passkeys work
• Why fake websites fail
• How to recognise legitimate prompts
• Why security keys matter

People adopt technology faster when they understand it.

Conditional Access Policies

Combine passkeys with Conditional Access.

Examples include:

• Require phishing-resistant MFA for administrators.
• Require compliant devices.
• Block legacy authentication.
• Protect security information registration.
• Restrict unmanaged devices.
• Protect guest users.

Layered security remains essential.

Monitor Adoption

Track:

• registered passkeys
• registered FIDO2 keys
• failed registrations
• helpdesk requests
• authentication success
• legacy method usage

Reporting identifies users who still depend on weaker methods.

Common Migration Mistakes

Avoid:

• forcing everyone on day one
• removing SMS immediately
• forgetting backup authentication
• poor user communication
• no recovery plan
• failing to pilot
• buying incompatible security keys
• not testing Conditional Access

Benefits Beyond Security

Businesses often discover:

• fewer password resets
• fewer MFA complaints
• faster sign-ins
• lower helpdesk workload
• improved user satisfaction
• reduced phishing success
• stronger cyber insurance position

Security and usability improve together.

Future-Proofing Your Identity Strategy

Passwords are gradually disappearing.

Microsoft, Google and Apple have all committed to expanding passwordless authentication.

Businesses that begin today will find future transitions significantly easier.

Passkeys are rapidly becoming the expected authentication method rather than an emerging technology.

A Practical Migration Checklist

✓ Inventory authentication methods

✓ Review Conditional Access

✓ Pilot with IT

✓ Deploy Temporary Access Pass

✓ Issue security keys

✓ Register passkeys

✓ Train users

✓ Remove weak methods

✓ Monitor adoption

✓ Review quarterly

Final Thoughts

Traditional MFA remains an essential security control, but the threat landscape has changed. Attackers are increasingly targeting authentication sessions, approval prompts and users themselves rather than simply stealing passwords.

Phishing-resistant MFA changes the model entirely. Passkeys and FIDO2 security keys use cryptographic authentication that is bound to the legitimate website, making credential phishing and many common MFA attacks dramatically less effective.

For most organisations, the best approach is a phased migration. Start with administrators and other high-risk users, introduce passkeys and security keys alongside existing methods, use Temporary Access Pass to simplify enrolment, and strengthen access further with Microsoft Entra Conditional Access and authentication strengths.

Moving to phishing-resistant MFA is not simply about meeting Microsoft’s latest recommendations—it is about reducing real-world business risk while giving employees a faster, simpler sign-in experience.

The sooner your organisation begins the transition, the easier it will be to stay ahead of evolving identity threats.

Ready to Move Beyond Traditional MFA?

Hamilton Group can help you plan and deploy phishing-resistant authentication across your Microsoft 365 environment.

Our experts can help you:

• Assess your current MFA configuration
• Deploy passkeys and FIDO2 security keys
• Configure Microsoft Entra Authentication Strengths
• Implement Conditional Access policies
• Protect administrator accounts
• Roll out Temporary Access Pass
• Train employees on passwordless authentication
• Secure Microsoft 365 against modern phishing attacks
• Review identity security and compliance
• Build a phased migration plan with minimal disruption

Visit hgmssp.com, call Hamilton Group on 0330 043 0069, or book a meeting with one of our Microsoft security specialists to future-proof your organisation’s identity protection.