Enabling MFA is one of the most impactful things you can do to protect your Microsoft 365 environment. But there is an assumption buried in that statement worth challenging: the idea that all MFA provides the same level of protection. It does not. A text message code, a push notification, and a FIDO2 passkey all count as a second factor, but they protect against fundamentally different threats. This post and accompanying video breaks down the differences and shows you how to enforce the right method for the right account using Authentication Strengths in Microsoft Entra ID.

MFA Methods – From Weakest to Strongest

SMS and Voice Calls are the most familiar MFA methods and the weakest ones still in widespread use. SMS is vulnerable to SIM swapping, where an attacker convinces a mobile carrier to transfer a phone number to a SIM card they control, giving them access to verification codes. It is also vulnerable to real-time phishing, where an attacker captures a code as it is entered and replays it before it expires. Microsoft has announced SMS and voice authentication will be retired starting September 2026. If your organization still relies on SMS, now is the time to plan the transition.

OATH Software Tokens are time-based one-time passwords generated locally on a device by an authenticator app, which makes them stronger than SMS. However, they share the same core weakness: a user can be tricked into entering a code on a fake login page and an attacker can replay it in real time. OATH tokens are not considered phishing-resistant.

Microsoft Authenticator with Number Matching is where most modern MFA deployments land. Push notifications without additional context are vulnerable to MFA fatigue attacks, where an attacker repeatedly sends approval requests hoping a user taps Approve just to make them stop. Number matching fixes this by requiring the user to enter a two-digit number displayed on the sign-in screen into the Authenticator app before the request can be approved. This breaks the fatigue attack completely. Number matching is enabled by default and cannot be disabled, which is a good thing. Additional context options can also show the application name and sign-in location in the notification, giving users more information before they approve.

FIDO2 Passkeys and Windows Hello for Business are the gold standard. The authentication is cryptographically bound to the exact domain the user is signing into. There is no code to intercept, no push notification to approve, and no way for an attacker to redirect authentication to a fake site because the verification only works on the exact domain it was registered with. These methods are fully phishing-resistant and should be the target for any account with privileged access.

The Authentication Methods Policy

The Authentication Methods policy in Entra ID is where you control which MFA methods are available across your tenant. This is the modern replacement for the older per-user MFA settings. From here you can enable or disable methods globally or target specific groups, so you can roll out FIDO2 passkeys to your IT team while keeping Microsoft Authenticator available for everyone else, or phase out SMS while maintaining it as a fallback during the transition.

Authentication Strengths in Conditional Access

Authentication Strengths let you require a specific set of MFA methods in a Conditional Access policy rather than accepting any MFA. Microsoft provides three built-in options. The standard MFA strength accepts any method. The passwordless MFA strength requires Microsoft Authenticator passwordless, FIDO2 passkeys, or Windows Hello for Business. The phishing-resistant MFA strength is the most restrictive and requires only FIDO2 passkeys, Windows Hello for Business, or certificate-based authentication.

You can also create custom Authentication Strengths. A useful custom option for organizations transitioning away from SMS is one that includes Microsoft Authenticator passwordless alongside FIDO2 passkeys and Windows Hello for Business, giving users flexibility while still requiring a strong method.

Enforcing Phishing Resistant MFA for Global Administrators

The practical application covered in the video updates the privileged role Conditional Access policy built in a previous video to require phishing-resistant MFA specifically rather than accepting any MFA method. To update the settings:

1. Open the existing policy.
2. Go to Grant under Access Controls.
3. Switch from Require multifactor authentication to Require authentication strength.
4. Select Phishing-resistant MFA.

Note that you cannot enable both controls at the same time, so the standard MFA requirement needs to be cleared first.

Before switching this policy from Report-Only to On, every administrator affected by the policy must have already registered a qualifying method. If phishing-resistant MFA is enforced before a user has a FIDO2 passkey, Windows Hello for Business, or certificate-based authentication registered, they will not be able to sign in. This is exactly the kind of misconfiguration that can lock administrators out of a tenant. Have each affected admin sign in to aka.ms/MySecurityInfo and confirm a phishing-resistant method is listed before you enforce anything.

Registering a Passkey in Microsoft Authenticator

The passkey registration experience is straightforward. Navigate to aka.ms/MySecurityInfo, select Add sign-in method, and choose Passkey in Microsoft Authenticator. The browser prompts you to open the Authenticator app, where you locate the account, select the option to create a passkey, re-authenticate to confirm your identity, and the passkey is created.

Users can manage all of their registered methods from aka.ms/MySecurityInfo at any time. Sharing this link proactively during an MFA rollout reduces helpdesk calls and gives users visibility into their own security setup.

Take Action Today

If your Global Administrators are still signing in with SMS or a standard push notification, phishing-resistant MFA is the upgrade that matters most. FIDO2 hardware keys are inexpensive and straightforward to deploy. The Authentication Methods policy and Authentication Strengths in Conditional Access give you the controls to enforce them without disrupting users who are not in scope. Start with your most privileged accounts, validate with the What If tool, and enforce only after registration is confirmed.

Links:

A Beginner’s Guide to the AZ-900
https://www.udemy.com/course/beginners-guide-az-900/?referralCode=C74C266B74E837F86969

Zero to Hero with Azure Virtual Desktop
https://www.udemy.com/course/zero-to-hero-with-windows-virtual-desktop/?referralCode=B2FE49E6FCEE7A7EA8D4

Hybrid Identity with Windows AD and Azure AD
https://www.udemy.com/course/hybrid-identity-and-azure-active-directory/?referralCode=7F62C4C6FD05C73ACCC3

Windows 365 Enterprise and Intune Management
https://www.udemy.com/course/windows-365-enterprise-and-intune-management/?referralCode=4A1ED105341D0AA20D2E

VIDEO: Passwords Alone DON’T WORK! Secure M365/Azure with Entra ID MFA!

VIDEO: Master Conditional Access in Entra ID: Assignments, Conditions, Controls!

Conditional Access, Break-Glass, Legacy Auth, & Named Locations: Entra ID it in Action!

Require multifactor authentication for admins
https://learn.microsoft.com/en-us/entra/identity/conditional-access/managed-policies#require-multifactor-authentication-for-admins

Mandatory multifactor authentication for Azure and admin portals
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet