Which Form of MFA Is the Most Secure in 2026 — and Which Is the Most Convenient? The Buff IT Guy’s Guide
Worked for 18s
Multi-factor authentication used to be simple advice:
Turn MFA on.
In 2026, that is no longer quite enough.
MFA is still one of the most important protections you can put around Microsoft 365 and other business accounts, but not every form of MFA provides the same level of security.
An SMS code is MFA.
A Microsoft Authenticator notification is MFA.
A FIDO2 security key is MFA.
A passkey protected by your fingerprint is MFA.
But they are not equally resistant to modern attacks.
The National Cyber Security Centre now specifically recommends organisations choose stronger MFA methods that provide better protection against phishing, while its April 2026 passkey guidance describes passkeys as both more secure and more user-friendly than traditional authentication methods.
So the question for businesses has changed from:
“Have we enabled MFA?”
to:
“What type of MFA are we actually using?”
The Buff IT Guy is here to sort out the difference.
What Is Multi-Factor Authentication?
Traditional authentication usually relies on something you know:
A password.
MFA adds another factor.
That might be something you have, such as a smartphone or security key, or something you are, such as a fingerprint or facial recognition.
This is why MFA provides significantly better protection than a password alone.
If an attacker steals your password, they still need the additional authentication factor.
The problem is that criminals have developed techniques for attacking some MFA methods too.
Modern phishing sites can sometimes capture passwords and one-time codes in real time. Attackers may also bombard users with push notifications hoping they will eventually press Approve simply to make the notifications stop.
That is why phishing resistance has become such an important consideration.
The Most Important MFA Word in 2026: Phishing-Resistant
Traditional MFA can prevent an attacker from simply entering a stolen username and password.
But imagine this scenario.
You receive an email saying:
“Your Microsoft 365 password expires today. Sign in now.”
You click the link.
The fake website looks exactly like Microsoft.
You enter your password.
Then it asks for the six-digit code from your authenticator app.
You enter that too.
An attacker sitting behind the fake site can potentially relay those credentials to the genuine Microsoft service while the authentication is still valid.
The NCSC specifically warns that traditional MFA methods can remain vulnerable to this type of live phishing because authentication secrets or approvals can be observed and relayed.
Passkeys and FIDO2 authentication work differently.
They cryptographically bind authentication to the legitimate website or service.
A fake Microsoft login page cannot simply take your passkey and reuse it against Microsoft's real service.
Microsoft describes FIDO2 passkeys as phishing-resistant credentials that can satisfy MFA when combined with device biometrics or a PIN.
That changes the MFA hierarchy considerably.
1. Passkeys and FIDO2 — The Strongest Choice
For most modern organisations, passkeys and FIDO2 authentication are among the strongest options available.
A passkey uses public-key cryptography rather than giving the website a reusable secret such as a traditional password.
The private part of the credential remains on the user's device or secure credential provider.
Authentication can then be unlocked using:
Fingerprint recognition
Facial recognition
Device PIN
A hardware security key
Microsoft Entra supports FIDO2 passkeys, while Microsoft's phishing-resistant authentication strength can be used through Conditional Access to require appropriate strong methods for sensitive users and resources.
This provides an important benefit:
The strongest MFA can now also be one of the easiest to use.
Instead of:
Password.
Wait for SMS.
Read six digits.
Type six digits.
Submit.
You might simply:
Touch the fingerprint reader.
Done.
Buff IT Guy Rule #1
The most secure authentication does not have to be the most annoying authentication.
That is one of the biggest improvements passkeys have brought.
What About Physical FIDO2 Security Keys?
Physical security keys remain an excellent choice, especially for highly privileged accounts.
The key might connect through USB, NFC or another supported interface.
Rather than receiving a code, the device participates cryptographically in authentication.
The NCSC ranks FIDO2 highly because it provides guessing resistance, phishing resistance and theft resistance when correctly implemented.
Security keys can therefore be particularly appropriate for:
Global Administrators.
IT administrators.
Finance directors.
Executives.
Other high-risk accounts.
The disadvantage is obvious.
You need the physical key.
Lose it without a properly planned backup authentication method and you may create an inconvenient Monday morning.
That is why deployment and account-recovery planning matter.
Windows Hello for Business
Windows Hello for Business is another powerful option for organisations using managed Windows devices.
Instead of typing the Microsoft 365 password repeatedly, the employee can authenticate using a PIN, fingerprint or facial recognition backed by cryptographic credentials tied to the device.
Microsoft includes Windows Hello for Business, FIDO2 security keys and certificate-based authentication among phishing-resistant authentication options.
The employee experience can therefore be extremely simple.
Open laptop.
Look at camera.
You're authenticated.
The Buff IT Guy barely gets time to flex.
2. Microsoft Authenticator — Good, but Understand Which Mode You're Using
Microsoft Authenticator deserves some nuance.
People often say:
“We use Authenticator.”
But Authenticator can support different authentication experiences.
For example, Authenticator push notifications with number matching are different from using a FIDO2 passkey stored through Microsoft Authenticator.
Traditional push authentication provides strong additional protection over passwords alone, but it is not inherently equivalent to phishing-resistant FIDO2.
A passkey stored through an authenticator can provide phishing-resistant authentication because it uses the FIDO2/WebAuthn model.
This is why simply asking:
“Do you use Microsoft Authenticator?”
is no longer enough.
You need to know how it is configured.
Buff IT Guy Rule #2
The app icon doesn't tell you the strength of the authentication method behind it.
3. Authenticator One-Time Codes
Time-based one-time passwords — commonly called TOTP codes — are still widely used.
You open an authenticator app.
It displays a six-digit number.
The number changes periodically.
You enter it into the website.
This is much better than relying on a password alone.
It also doesn't depend on mobile phone reception.
But it is still vulnerable to phishing.
If a fake website asks for the code and the employee provides it, an attacker may be able to relay that code to the genuine service before it expires.
The NCSC specifically notes this weakness in OTP-based authentication.
So TOTP remains useful.
But it is no longer the strongest option where phishing-resistant authentication is available.
4. SMS Codes — Better Than No MFA, but Increasingly Legacy
SMS has historically been popular because everybody understands it.
Login.
Receive text.
Enter code.
Done.
That simplicity made SMS one of the easiest ways for businesses to deploy MFA quickly.
But SMS has weaknesses.
Authentication depends on the mobile telephone network, and codes can still be entered into phishing websites. There are also risks around number reassignment and attacks targeting mobile accounts.
That doesn't mean businesses should disable SMS tomorrow without providing an alternative.
SMS MFA is still considerably better than protecting an important account with a password alone.
But businesses should now be planning beyond it.
And Microsoft has given organisations a very significant reason to do so.
Microsoft Is Retiring Its Own SMS and Voice MFA Delivery
This is one of the biggest authentication changes businesses need to be aware of.
Microsoft has announced that Microsoft-provided SMS and voice authentication in Microsoft Entra ID is scheduled to be fully retired from 1 February 2027.
Microsoft is explicitly directing organisations towards phishing-resistant methods such as passkeys, Windows Hello and FIDO2 ahead of that date.
That means businesses heavily dependent on Microsoft sending SMS authentication codes should not leave migration planning until January 2027.
As of August 2026, there is now less than six months before that scheduled retirement date.
The direction Microsoft is taking is extremely clear:
Move away from legacy telecommunications-based MFA and towards phishing-resistant authentication.
Buff IT Guy Rule #3
If Microsoft has already told you the old road closes in February, don't wait until January to start looking for another route.
Which MFA Method Is the Most Convenient?
The surprising answer in 2026 may be:
Passkeys.
Traditional thinking assumed there was always a trade-off:
More security = more inconvenience.
That does not necessarily hold anymore.
A passkey protected by facial recognition or a fingerprint can actually require less effort than entering a password and then typing a code.
The NCSC now explicitly describes passkeys as both secure and user-friendly and says they should become the default authentication option for consumers where supported.
For business authentication, the exact implementation depends on the environment, but the usability principle remains.
A well-designed passwordless system can simultaneously reduce:
Password fatigue.
Forgotten passwords.
MFA codes.
Repeated authentication prompts.
Phishing exposure.
That is a significant improvement.
Our 2026 MFA Ranking
For a Microsoft-focused business, a useful practical hierarchy is:
Strongest: Passkeys/FIDO2, Windows Hello for Business and appropriate certificate-based authentication.
Very strong: Other properly implemented passwordless authentication methods.
Good: Microsoft Authenticator push with number matching.
Acceptable where stronger methods aren't available: Authenticator TOTP codes.
Legacy/fallback: SMS and voice authentication.
Avoid: Password-only authentication for important business services.
The exact answer can vary depending on the application and user population, but the principle is consistent with both Microsoft and NCSC guidance:
Use the strongest phishing-resistant method your service can support.
What Hamilton Group Is Doing About MFA in 2026
At Hamilton Group, we're moving the conversation beyond simply asking whether MFA is switched on.
For businesses using Microsoft 365, the more important questions now include:
Which authentication methods are enabled?
Are administrator accounts using stronger authentication than ordinary users?
How dependent is the organisation on SMS?
Can users move towards passkeys or Windows Hello?
Are Conditional Access policies enforcing appropriate authentication strength?
What happens when somebody loses their phone or security key?
Our approach is to help customers move towards phishing-resistant authentication where it is practical, while making sure the migration does not create unnecessary disruption.
That can include reviewing Microsoft Entra authentication methods, reducing dependency on legacy SMS and voice authentication, implementing Conditional Access, protecting privileged administrator accounts, introducing FIDO2/passkeys and Windows Hello where appropriate, and ensuring there is a sensible recovery process when an authentication device is lost.
Microsoft's authentication-strength controls also allow organisations to require stronger methods for particularly sensitive resources or administrative users without necessarily forcing the identical authentication method onto every employee.
That is often a better approach than applying one blanket rule to the entire organisation.
Protect Administrator Accounts First
If you aren't ready to move every employee to phishing-resistant MFA immediately, start with the accounts that can cause the most damage if compromised.
That normally means privileged administrator accounts.
A Microsoft 365 Global Administrator potentially has access to enormous parts of the organisation.
Those accounts deserve more protection than an ordinary user account.
Microsoft specifically publishes Conditional Access guidance for requiring phishing-resistant MFA for administrator roles.
The Buff IT Guy's view is straightforward:
If an account has the keys to the entire building, don't protect it with the same lock as the stationery cupboard.
Don't Forget Account Recovery
Strong authentication can introduce another challenge.
What happens when:
An employee loses their phone?
A security key disappears?
A laptop fails?
An employee receives a replacement device?
A biometric sensor stops working?
Good MFA deployment includes a recovery strategy.
Otherwise, organisations sometimes weaken security again because one executive gets locked out and demands that every protective control be removed immediately.
Backup authentication methods should be carefully planned.
IT should also have secure processes for onboarding new authentication methods and verifying that a person requesting an MFA reset is genuinely the user they claim to be.
An attacker who cannot defeat MFA technically may simply phone the helpdesk and attempt to persuade somebody to reset it.
Technology and process need to work together.
So, Which MFA Should Your Business Use in 2026?
If your systems support phishing-resistant authentication, that is where businesses should increasingly be heading.
For Microsoft environments, that may mean:
Passkeys.
FIDO2 security keys.
Windows Hello for Business.
And stronger Conditional Access requirements for sensitive accounts.
Microsoft Authenticator remains extremely useful, particularly when configured appropriately.
TOTP remains better than password-only authentication.
SMS remains preferable to no MFA at all while organisations migrate.
But SMS should increasingly be viewed as a transition technology rather than the end goal, particularly with Microsoft's own SMS and voice delivery scheduled for retirement on 1 February 2027.
The Buff IT Guy Verdict
Five years ago the recommendation was:
Turn MFA on.
In 2026 it should be:
Turn strong MFA on — and make it phishing-resistant wherever possible.
The good news is that businesses no longer necessarily have to choose between security and convenience.
A fingerprint, face scan, Windows Hello sign-in or passkey can be easier for employees while offering considerably stronger protection against phishing than passwords and one-time codes.
That is progress the Buff IT Guy can get behind.
Preferably with both biceps.
Want to Improve Microsoft 365 Authentication?
Hamilton Group can help businesses review how employees and administrators authenticate to Microsoft 365 and identify where older methods such as SMS can be replaced with stronger alternatives.
We can help with Microsoft Entra ID, Conditional Access, MFA, passkeys, FIDO2, Windows Hello for Business, Microsoft 365 security, device management and wider cyber-security controls.
With Microsoft's own SMS and voice MFA delivery scheduled for retirement in February 2027, now is a good time to review what authentication methods your organisation actually depends upon.
And when your team needs IT support, our aim is to make first contact within 15 minutes.
Call Hamilton Group on 0330 043 0069 or visit hgmssp.com to speak with one of our Microsoft 365 and cyber-security experts.