Phishing-Resistant MFA: What It Is and How to Roll It Out

Multi-factor authentication stops many attacks, but not every kind of MFA is equal. Attackers now use fake login pages that pass a stolen password and code to the real site in real time. Others send repeated push prompts until a tired employee taps approve. Phishing-resistant MFA is designed so that those tricks do not work.

What makes MFA phishing-resistant

Standards such as FIDO2 and WebAuthn use public key cryptography. Your device holds a private key and will only use it for the genuine website it was registered with. A look-alike domain gets nothing, and there is no code for the user to type into the wrong page.

• Passkeys

  Stored on a phone, laptop or password manager and unlocked with a fingerprint, face or PIN. Easy for most staff.

• Hardware security keys

  Small physical devices that plug in or tap. A strong choice for administrators and high-risk roles.

• Smart cards and certificates

  Common in government and regulated organizations with existing infrastructure.

A staged rollout plan

• 1. Inventory

  List your identity provider, your key applications, and any legacy systems that still accept passwords alone.

• 2. Protect administrators first

  Move global admins, cloud admins and IT staff first, since their accounts can do the most damage.

• 3. Add high-risk roles

  Finance, HR, executives and anyone who approves payments or handles sensitive data.

• 4. Expand to all staff

  Roll out in groups with clear guides and a help desk ready. Provide a spare key or second device for each person.

• 5. Remove the weak options

  Once adoption is high, turn off SMS and other phishable methods, and block legacy authentication.

Do not forget recovery

If a person loses a device, how do they get back in? If the answer is a quick call to the help desk, an attacker can make that same call. Require identity checks for resets, such as a video call with a manager or a verified employee record, and log every recovery event for review.

How attackers get past ordinary MFA

To choose the right method, it helps to understand what you are defending against. Most MFA bypasses do not break the technology. They trick a person or steal what comes after the login.

• Adversary-in-the-middle phishing

  The victim visits a convincing fake login page that forwards everything to the real site. The password and the one-time code both pass through, and the attacker keeps the signed-in session.

• Push fatigue

  The attacker already has the password and triggers repeated approval prompts, often late at night, until someone taps approve. Number matching reduces this risk, but it does not remove phishing entirely.

• SIM swapping

  The attacker persuades a mobile carrier to move a number to a new SIM, so text message codes go to them.

• Help desk social engineering

  The attacker calls IT, pretends to be an employee who lost a phone, and asks for MFA to be reset. Stronger technology does not help if this door stays open.

• Session theft

  Malware on a device can steal a session cookie after a legitimate login. This is why device health checks and short session lifetimes matter alongside strong sign-in.

Passkeys or hardware keys: how to choose

Both options use the same FIDO standards, but they suit different people. Synced passkeys are backed up through a platform account or password manager, which makes them convenient and easy to recover. Device-bound passkeys and hardware keys stay on one device, which gives stronger control over where the credential exists.

A practical split for most companies is synced or device-bound passkeys for general staff, and hardware keys for administrators, executives and anyone who can move money. Give each hardware key user two keys, and store the second one safely. If you work in a regulated field, check your requirements first. NIST SP 800-63B sets out assurance levels for US federal systems and is a useful reference, and CISA has published practical guidance on implementing phishing-resistant MFA.

Handle the exceptions

Rollouts usually slow down because of the small number of cases that do not fit. List these early and give each one an owner and an end date.

• Legacy applications

  Put older apps behind your identity provider using single sign-on or an access proxy. Where that is impossible, restrict network access and plan a replacement.

• Legacy protocols

  Older mail protocols such as IMAP and POP may not support modern sign-in. Block them once you confirm nothing still depends on them.

• Service accounts

  These cannot use MFA. Inventory them, remove interactive login, use managed identities where possible, and rotate any remaining credentials.

• Shared accounts

  Replace them with individual access wherever possible, so that every action can be traced to one person.

• Frontline and shared devices

  Staff without company phones may need security keys or badge-based sign-in. Test with those teams directly before you set a deadline.

• Contractors

  Decide whether they use your identity system or their own, and apply the same strength of sign-in to their access.

Combine strong sign-in with conditional access

Strong MFA proves who is signing in. Conditional access decides whether that sign-in should be allowed under the current circumstances. Together they close many of the gaps that MFA alone leaves open. Common rules include requiring phishing-resistant methods for admin roles, requiring a managed and healthy device for sensitive applications, blocking sign-ins from countries where you do not operate, and asking for reauthentication before high-risk actions.

Roll out these policies in report-only mode first, if your identity provider supports it. You can then see who would have been blocked before you affect anyone's work. Always keep two emergency administrator accounts outside normal policies, protect them with hardware keys, and alert on any use of them.

How to measure progress

Report a few simple numbers to leadership each month: the percentage of administrators on phishing-resistant MFA, the percentage of all staff enrolled, the number of accounts still using SMS, the number of applications outside single sign-on, and the number of MFA resets, with any that failed identity checks. These figures show real risk reduction, and they make it clear where the remaining work sits.

Where NPLUS Global helps

Our identity and access team reviews your current sign-in methods, designs the rollout by role, sets up single sign-on and conditional access, and helps your team retire weak methods without disrupting work.