Phishing-Resistant MFA Setup Guide

This guide walks you through securing employee accounts with phishing-resistant multi-factor authentication (MFA). You’ll learn what it is, how to deploy it, and how to avoid common pitfalls. By the end, your organization will be significantly more protected against credential theft and account takeover.

What You’ll Need

• Administrative access to your identity provider (IdP) or directory service (e.g., Microsoft Entra ID, Okta, Google Workspace).
• A clear policy on which accounts require phishing-resistant MFA (typically all users, but at minimum admins and finance).
• Hardware security keys (e.g., YubiKey, Google Titan) or devices supporting passkeys (FIDO2).
• A plan for enrollment and support, including backup keys and a temporary exception process.

Step-by-Step

1. Assess your current MFA setup. Check which MFA methods are enabled. If you’re using SMS, voice, or OTP apps, those are not phishing-resistant. Note the number of users and their roles.
2. Choose your phishing-resistant method. FIDO2/WebAuthn (passkeys or hardware keys) and smart cards (PIV/CAC) are considered phishing-resistant. For most cloud-based IdPs, FIDO2 is the practical choice.
3. Purchase and distribute hardware keys. If you’re using hardware keys, order enough for each user plus a spare. Distribute them securely—ideally during a scheduled enrollment session.
4. Enable FIDO2/passkey authentication in your IdP. In Microsoft Entra ID, go to Security > Authentication methods and enable “FIDO2 security key” or “Passkey”. In Okta, go to Security > Multifactor and enable “WebAuthn”. Follow your IdP’s documentation for exact steps.
5. Create a conditional access policy (if using Entra ID). Require phishing-resistant MFA for all users or for specific groups. For example, require FIDO2 for admins and high-risk roles. Set up a policy that blocks legacy authentication (which doesn’t support MFA).
6. Enroll users. Ask users to register their security key or passkey. Provide clear instructions and a support channel. For remote users, send them a self-service enrollment link.
7. Set up backup methods. Every user should have at least one backup key or a recovery passkey. For example, a user could have two hardware keys, or one hardware key and a passkey on their phone.
8. Test with a pilot group. Start with IT staff and a few volunteers. Verify that login works, including passwordless scenarios if you’re enabling them.
9. Roll out to all users. Communicate the change, set a deadline, and enforce the policy. Provide a help desk contact for issues.
10. Monitor and review. Check sign-in logs for failures or users who haven’t enrolled. Follow up with those users. Regularly review your MFA policy to ensure it remains effective.

Common Mistakes

• Leaving SMS or OTP enabled as a fallback. This weakens your security, as attackers can still use those methods. Disable them once phishing-resistant MFA is fully rolled out.
• Not blocking legacy authentication. Many attacks use legacy protocols (IMAP, POP, SMTP) that bypass MFA entirely. Ensure you block these.
• Forgetting about service accounts. Service and break-glass accounts need special handling. Don’t apply the same MFA policy to them blindly; use conditional access or exclude them with strong compensating controls.
• Insufficient user training. Users may not know how to use a security key or passkey. Provide clear instructions and a short video or FAQ.

Tips

• Use conditional access to require phishing-resistant MFA only for privileged roles first, then expand to all users.
• Enable passwordless sign-in where possible—users will find it more convenient and it reduces password-related risks.
• Store backup keys in a secure location, such as a locked drawer or with your IT department.
• Regularly audit who has enrolled and who hasn’t. Use reports from your IdP to track adoption.
• Consider using temporary access passes (TAPs) in Entra ID to help users enroll without needing a password.

Troubleshooting

• User can’t register their key. Check that the user is using a supported browser (Chrome, Edge, Firefox, Safari) and that the key is inserted correctly. Try a different USB port. If using NFC, ensure it’s enabled.
• Key works on one device but not another. Some keys require a PIN or have different protocols. Check your IdP’s requirements. Also, ensure the user is using the correct key (e.g., not a backup key that hasn’t been registered).
• User locked out. Have a recovery process in place. Use a temporary access pass or a global admin can reset their MFA methods. Ensure you have a break-glass account that doesn’t rely on MFA (but is protected by other means).
• Passkey not working on a phone. Ensure the phone’s Bluetooth is on if using a cross-device passkey. Also, check that the phone is running a compatible OS version.
• Legacy apps still prompting for passwords. Those apps may not support MFA. You’ll need to either update them to modern authentication or block them and use alternatives.

Frequently Asked Questions

What exactly makes MFA “phishing-resistant”?

Phishing-resistant MFA uses methods where the authentication factor is bound to the specific website or app you’re signing into. This prevents attackers from replaying credentials on a fake site. FIDO2/passkeys and smart cards are phishing-resistant; OTPs and SMS are not.

Do I need to buy hardware keys for every employee?

Not necessarily. Passkeys on phones and computers are also phishing-resistant and can be used. Hardware keys are recommended for admins and high-risk users, but you can use passkeys for everyone if your IdP supports them.

Can I keep using Microsoft Authenticator or Google Authenticator?

Those apps generate OTPs, which are not phishing-resistant. Some apps now support passkeys, but if you’re using the OTP function, it’s not sufficient for phishing resistance.

What if an employee loses their security key?

Have a policy in place. The employee should report it immediately. You can revoke the key from your IdP and issue a new one. Ensure they have a backup key or another method to log in during the transition.

How long does it take to roll out?

It depends on your organization size. A pilot can take a week, and full rollout can take a few weeks to a few months, depending on user training and support.

Will this affect employees using personal devices?

Yes, they may need to install an authenticator app or use a passkey on their personal phone. This is generally acceptable, but you should communicate the policy clearly and provide opt-out options for those who can’t use personal devices.

Related

• Oculus Go VR Headset: What It Is & How It Works
• Print to Envelope: Sites & How to Do It
• Avoid Inbox Clutter: Spam Reduction Guide