Phishing-resistant MFA: moving to FIDO2 passkeys

Turning on MFA is still one of the most effective security measures you can deploy, but not all methods are equal. Codes sent by SMS or email, or generated in an authenticator app, can be intercepted or captured by a phishing site that replays your credentials in real time. Attackers also exploit push notification fatigue, sending repeated approval prompts until a user finally gives in out of sheer tiredness. The result is frustrating: you think you are protected, while a gap remains. This article explains why these methods show their limits and how FIDO2 passkeys answer them in practice.

Why SMS and app codes no longer cut it

What these methods share is that they rely on a secret the user can pass on, deliberately or not. A well-built phishing site sits between the user and the legitimate service, captures the code as it is typed, and replays it instantly. Classic MFA slows the attacker down, but does not stop them.

• SMS: vulnerable to SIM swapping and network interception.
• One-time passcodes (OTP) from apps: can be typed into a fake site that relays them instantly.
• Simple push notifications: prone to approval harassment (MFA fatigue).
• None of these methods verifies the real address of the site you are signing in to.

The real-time attack, explained simply

Picture an employee who receives an email imitating the company sign-in portal. They click, land on a page identical to the real one, enter their password and then their app code. Behind the scenes, a proxy server controlled by the attacker forwards this information to the real service at the same instant, grabs the session token and takes over. The employee saw nothing wrong: they received their code and typed it in. It is exactly this scenario, known as adversary-in-the-middle, that passkeys make ineffective.

What FIDO2 passkeys change

A passkey relies on public-key cryptography. The private key never leaves the device or security key, and authentication is bound to the legitimate domain. In practice, a passkey simply refuses to sign a request coming from a fake domain: real-time phishing stops working, because there is no reusable secret left to steal.

• Phishing resistance: domain verification is built into the protocol.
• Nothing to copy: no code to intercept or type into a fake site.
• Local unlock via biometrics or PIN, never sent to the server.
• Multiple form factors: physical security keys, Windows Hello, platform passkeys.

Choosing the right form factor for each use

There is no single ideal form factor. A physical security key (a FIDO2-certified USB or NFC key, for example) is a great fit for privileged accounts and shared workstations, because it is independent of the device. Windows Hello for Business relies on biometrics or a PIN and suits personal, named workstations. Platform passkeys, synced through the device ecosystem, ease adoption on mobile. Many organisations combine all three depending on the profile.

How to roll it out in stages

Moving to passkeys is not an all-at-once switch. You start with the most exposed accounts, test, then generalise once usage is validated and users are equipped. A brutal tenant-wide flip is the surest way to create lockouts and turn teams against the change.

1. 1Enable phishing-resistant methods in Microsoft Entra (FIDO2 passkeys, Windows Hello for Business).
2. 2Enrol privileged accounts (administrators) first, as they are the priority targets.
3. 3Require a phishing-resistant authentication strength via a Conditional Access policy for sensitive roles.
4. 4Test the policy in report-only mode to measure the impact before enforcing it.
5. 5Extend gradually to standard users after a testing and communication phase.

Start with privileged accounts

A compromised administrator account can mean the whole tenant falls. That is why administrators should be the first protected by phishing-resistant authentication. The volume is small (a handful of accounts), the security impact is maximal, and it lets you rehearse the enrolment procedure before extending it to hundreds of users.

Anticipating user objections

Any change to authentication raises questions. Yet passkeys are simpler to use than a code to copy: a glance or a fingerprint is enough. To make the transition succeed, prepare clear communication, plan a backup method in case a device is lost, and support your first users.

• Explain the concrete gain: fewer codes to type, more security.
• Register at least two methods per user to avoid lockout.
• Document the re-enrolment procedure in case of loss or theft.
• Track the adoption rate and follow up with stragglers.

Plan a reliable backup method

The most common fear is simple: what happens if I lose my key or my phone? Without a clear answer, adoption stalls. So plan at least a second phishing-resistant method per user and a fast support procedure to re-enrol a lost device. Avoid falling back on SMS as a backup, or you reopen exactly the gap you set out to close.

Common mistakes to avoid

• Leaving SMS active as a fallback, which cancels out the benefit of passkeys.
• Permanently excluding administrators from the policy 'to avoid lockout', then forgetting to remove the exclusion.
• Enforcing the requirement with no test phase or communication, triggering a wave of tickets.
• Registering only one method per user, guaranteeing a lockout at the first lost device.
• Never checking afterwards that the policy actually applies to the intended scope.

How AuPoint helps

AuPoint helps you deploy these Conditional Access policies in plain language, without PowerShell, with an impact preview before activation to avoid any lockout. You can see which accounts would be affected before pressing the button, which removes the main source of anxiety when hardening authentication. The platform then links this measure to the relevant frameworks and computes a coverage score.

Frequently asked questions

Does a passkey fully replace the password?

It can replace it in passwordless scenarios, or sit alongside it as a phishing-resistant second factor. Many organisations start with the passkey as a strong factor, then move to genuinely passwordless sign-in once usage has stabilised.

Do we have to buy physical keys?

No. Windows Hello for Business and platform passkeys require no extra hardware purchase. Physical keys remain recommended for privileged accounts and shared workstations, where independence from the device is an advantage.

Do passkeys work on mobile?

Yes. The major mobile systems support passkeys, unlocked with biometrics. It is often the smoothest form factor for mobile users, provided you plan a backup method in case they change device.

In short, FIDO2 passkeys close a gap that classic MFA leaves open, and their rollout stays under control when you proceed in stages. With AuPoint, you deploy these Conditional Access policies in plain language, preview their impact, and generate a dated compliance report exportable to PDF, with a coverage score per framework (ISO 27001, NIS2, GDPR). That way you prove your strong authentication is genuinely in place, not merely announced.