Phishing-Resistant MFA & Conditional Access Setup

This guide walks you through protecting Microsoft 365 accounts with phishing-resistant multifactor authentication (MFA) and Conditional Access policies. It covers the necessary prerequisites, step-by-step configuration, common pitfalls, and troubleshooting so you can reduce the risk of account takeover and meet compliance requirements.

What You’ll Need

• Microsoft 365 tenant with an account that has the Global Administrator role.
• Licenses that include Azure AD Premium P1 or P2 (for Conditional Access).
• Access to the Microsoft Entra admin center (formerly Azure Active Directory).
• For phishing-resistant methods: either Windows Hello for Business, FIDO2 security keys, or certificate-based authentication (CBA) configured on devices.
• Optional: a test user account to validate policies before broad rollout.

Step-by-Step

1. Enable phishing-resistant MFA methods in the tenant.
   Go to Microsoft Entra admin center > Protection > Authentication methods > Policies. Under Microsoft Entra ID, select FIDO2 security keys and Windows Hello for Business. Click Enable and target specific users or groups. For certificate-based authentication, configure the CBA policy with the trusted root CA and user binding.
2. Create a Conditional Access policy that requires phishing-resistant MFA.
   In the admin center, go to Protection > Conditional Access > Policies. Click New policy. Name it e.g., “Require Phishing-Resistant MFA for All Users”. Under Assignments, include All users (or a pilot group). Under Cloud apps or actions, select All cloud apps. Under Access controls > Grant, choose Require multifactor authentication and check Require authentication strength — select the built-in Phishing-resistant MFA strength (which includes FIDO2, Windows Hello, and certificate-based auth). Set Enable policy to Report-only first.
3. Test the policy in report-only mode.
   Sign in as a test user with a phishing-resistant method. Go to Sign-in logs in Entra ID and verify that the policy would have required MFA. Check that the authentication method used is indeed phishing-resistant. Adjust the policy if needed.
4. Exclude break-glass accounts.
   Always exclude at least one emergency access account (a cloud-only account with a very strong password and no MFA) from all Conditional Access policies to avoid lockout. Add that account under Exclude in the policy.
5. Enable the policy.
   Once testing passes, change the policy state from Report-only to On. Monitor sign-in logs for failures.
6. Optionally, block legacy authentication.
   Create a separate Conditional Access policy that blocks legacy authentication (e.g., basic auth for Exchange Online). Under Client apps, select Exchange ActiveSync and Other clients (legacy). Set access control to Block access. This reduces attack surface.
7. Enforce MFA registration.
   If using Azure AD P2, create a Conditional Access policy that requires users to register a phishing-resistant method. Under Grant, select Require multifactor authentication registration. This ensures new users set up a secure method before accessing resources.

Common Mistakes

• Not testing in report-only mode. This can lock out users if the policy is misconfigured.
• Forgetting to exclude break-glass accounts. This can lead to permanent lockout.
• Enabling FIDO2 but not configuring the security key settings properly. Users need to know which keys are allowed and how to register them.
• Using a weaker authentication strength. If you select just “Require MFA” without the phishing-resistant strength, users can still use phone call or SMS, which are phishing-prone.
• Not blocking legacy authentication. Legacy protocols ignore MFA, so they remain a vulnerability.
• Applying the policy to all users at once without a pilot. It’s safer to roll out to a small group first.

Tips

• Use phishing-resistant authentication strength (predefined) rather than building a custom one, unless you have specific needs.
• For FIDO2 keys, ensure they are certified by the FIDO Alliance (e.g., YubiKey or others).
• Communicate with users before enabling: provide instructions on how to register a security key or Windows Hello.
• Regularly review sign-in logs and Conditional Access insights to spot anomalies.
• Combine with Identity Protection (P2) to require MFA on risky sign-ins, but note that risk-based policies still rely on the same MFA strength.
• Use authentication strengths to differentiate: e.g., require phishing-resistant for admins, but allow regular MFA for others if needed.

Troubleshooting

• Users cannot register a FIDO2 key. Check that the FIDO2 policy is enabled and that the user is in the targeted group. Also ensure the security key is compatible with the browser (Edge or Chrome).
• Sign-in fails even with a security key. Verify that the key is registered to the user. In Entra admin center, go to the user’s Authentication methods and see if the key is listed. Also check the sign-in log for the specific error code.
• Policy is in report-only but users are blocked. This can happen if another policy (e.g., MFA per-user) is active. Disable per-user MFA or exclude the user from that policy.
• Windows Hello not working. Ensure the device is Azure AD joined or hybrid joined, and that the Windows Hello policy is enabled. Check that the user has a PIN set up.
• Conditional Access policy not applying. Check the sign-in log to see if the policy is listed under “Conditional Access” tab. If not, confirm the policy is enabled and the assignments match.
• Legacy authentication still works. Ensure the block policy is applied to All cloud apps and that the client apps include legacy. Also note that some protocols like IMAP may need to be disabled separately.

Frequently Asked Questions

1. Can I use a phone app like Microsoft Authenticator as phishing-resistant?
   No, standard push notifications or OTP are not phishing-resistant. However, Microsoft Authenticator can be used in phone sign-in mode with number matching, but it’s still not as secure as FIDO2. For true phishing resistance, use FIDO2 keys or Windows Hello.
2. What is the difference between MFA and phishing-resistant MFA?
   Regular MFA (like SMS or OTP) can be intercepted or phished. Phishing-resistant methods use public/private key cryptography and tie the authentication to the device and the specific site, so even if a user is tricked into entering credentials, the attacker cannot replay the MFA.
3. Do I need Azure AD P2 for Conditional Access?
   Conditional Access requires P1. P2 adds Identity Protection features, but the core policies work with P1. The built-in authentication strength is available in both P1 and P2.
4. Can I require phishing-resistant MFA only for admins?
   Yes, you can scope the policy to a group containing admin roles. It’s recommended to start with admins, then expand.
5. What happens if a user loses their security key?
   They can use an alternate method (if you allow it) or contact IT to reset. You can temporarily exclude them from the policy or provide a temporary access pass.
6. Does this work with third-party MFA providers?
   Conditional Access can integrate with some third-party MFA via federation, but the built-in authentication strength is for Microsoft’s methods. For phishing resistance, you’d need to configure certificate-based auth or FIDO2 federation.

Related

• How to Silence Calls on iPhone
• Lenovo Laptop Running Slow Windows 10? Fixes That Work
• How to Clone Hard Drive to SSD on Windows