Microsoft 365 MFA methods compared, from SMS to passkeys

Multifactor authentication (MFA) adds a second check at sign-in, beyond a password. In Microsoft 365, MFA methods are registered and enforced in Microsoft Entra ID, the identity service behind each tenant, and Microsoft lists passkeys (FIDO2), FIDO2 security keys, Windows Hello for Business and certificate-based authentication among the methods that resist phishing. Microsoft’s documentation says traditional MFA “significantly improves security over password-only systems”. It also distinguishes between methods that resist phishing and methods that don’t. This page sets out how Microsoft and the Australian Signals Directorate (ASD) describe phishing-resistant MFA in Microsoft 365, and how it differs from methods such as SMS codes and app notifications.

Phishing-resistant and phishing-prone methods

Microsoft’s authentication methods documentation lists these as phishing-resistant:

• Windows Hello for Business
• Platform Credential for macOS
• synced passkeys (FIDO2)
• FIDO2 security keys
• passkeys in Microsoft Authenticator
• certificate-based authentication.

Microsoft states that it recommends phishing-resistant methods such as Windows Hello for Business, passkeys (FIDO2) and FIDO2 security keys, or certificate-based authentication “because they provide the most secure sign-in experience”. The same page says that SMS, email one-time passcodes and authenticator apps add friction for users, and that “these MFA options are prone to remote phishing attacks”, which it describes as attackers using social engineering and AI-driven tools to steal credentials such as passwords or one-time codes without physical access to a user’s device.

ASD’s guidance on implementing MFA takes a similar position. It says “multi-factor authentication is most effective when one of the authentication factors uses public key cryptography”, gives security keys and software certificates (with Windows Hello for Business and passkeys as common implementations) as examples, and describes SMS messages and voice calls as “weaker multi-factor authentication implementations” because “telecommunication networks do not provide end-to-end security”.

How the common methods compare

Number matching. Microsoft describes number matching as “a key security upgrade to traditional second-factor notifications in Authenticator”. When users respond to a push notification, they see a number and enter it into the app to complete the approval. Microsoft states that “Number matching is enabled for all Authenticator push notifications” and that users can’t opt out of it.

Why passkeys resist phishing

A passkey is a cryptographic credential tied to an account on a particular website or app. ASD’s passkeys guidance explains that passkeys stop cybercriminals from stealing an account password through scams or by tricking someone into signing in to a fake website. Microsoft’s authentication strength documentation describes its phishing-resistant category as methods “that require an interaction between the authentication method and the sign-in surface”. Passkeys explained covers the idea for everyday users.

Where official guidance places emphasis

• Emergency access accounts. Microsoft’s emergency access documentation lists a passkey (FIDO2) as the recommended method, with certificate-based authentication as an option where a PKI already exists. It also describes using “phishing-resistant authentication methods (FIDO2 security keys or certificate-based authentication) that are different from your normal admin accounts”; for example, a FIDO2 security key for emergency accounts if normal admin accounts use the Authenticator app. Microsoft 365 admin roles and least privilege covers emergency access accounts in more detail.
• Administrator accounts. Microsoft’s best practices for Entra roles describe turning on MFA for all administrator accounts. Microsoft’s mandatory MFA documentation states that MFA is required for accounts signing in to the Azure portal, the Microsoft Entra admin center and the Microsoft Intune admin center, with enforcement for the Microsoft 365 admin center gradually beginning from February 2025. It adds that emergency access accounts are also required to sign in with MFA, and names passkey (FIDO2) and certificate-based authentication as methods that satisfy the requirement.
• All online services. ASD’s implementing-MFA guidance says phishing-resistant MFA should be implemented for all online services, systems and data repositories.
• Requiring a method. Microsoft describes three built-in Conditional Access authentication strengths: Multifactor authentication strength, Passwordless MFA strength and Phishing-resistant MFA strength. Microsoft’s authentication strengths page states that “To use Conditional Access, your tenant needs to have Microsoft Entra ID P1 license.” Security defaults vs Conditional Access explains how these policies differ from the fixed security defaults.

How to check and require MFA methods

Check which methods are on and registered

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s pages on the Authentication methods policy and authentication methods activity have the latest steps.

• Methods allowed in the tenant: in the Microsoft Entra admin center, go to Entra ID > Authentication methods > Policies (at least Authentication Policy Administrator). Microsoft’s page also describes moving older per-user MFA and self-service password reset settings into this policy.
• Methods people have registered: go to Entra ID > Authentication methods > Activity. The Registration tab includes User registration details. Microsoft says a Microsoft Entra ID P1 or P2 licence is needed for this report.

Require phishing-resistant MFA for admins

Microsoft publishes a Conditional Access policy for this. Based on Microsoft’s instructions (checked October 2026); Microsoft’s policy guide has the full steps, including which admin roles to include.

1. Go to Entra ID > Conditional Access > Policies and create a new policy.
2. Include the administrator roles, and under Exclude choose the organisation’s emergency access or break-glass accounts.
3. Under Access controls > Grant, select Grant access, then Require authentication strength and Phishing-resistant MFA strength.
4. Set Enable policy to Report-only first, and turn it On only after checking its impact.

Conditional Access needs Microsoft Entra ID P1, as noted above. Microsoft’s page describes confirming the settings with policy impact or report-only mode before switching the policy on.

Lost or replaced devices

• Temporary Access Pass. Microsoft describes a Temporary Access Pass (TAP) as “a time-limited passcode that can be configured for single use or multiple sign-ins”. Microsoft says users “can sign in with a TAP to onboard other passwordless authentication methods”, and that a TAP “makes recovery easier when a user loses or forgets a strong authentication method”. Microsoft’s TAP page also notes that users who update methods after losing a device or credential should remove the old methods.
• Backup security keys. ASD’s passkeys guidance states: “It is recommended to create and store a backup passkey on a second FIDO2 security key”, so access isn’t lost if the first key is misplaced, stolen or broken.

Common questions

Which MFA methods are phishing-resistant in Microsoft 365?

Microsoft’s authentication methods documentation lists Windows Hello for Business, Platform Credential for macOS, synced passkeys (FIDO2), FIDO2 security keys, passkeys in Microsoft Authenticator and certificate-based authentication as phishing-resistant. Microsoft says it recommends these “because they provide the most secure sign-in experience”. Phishing-resistant and phishing-prone methods has the full list, and How the common methods compare sets them side by side.

Is SMS a secure MFA method for Microsoft 365?

Microsoft and ASD both describe SMS as a weaker option. Microsoft says traditional MFA, including SMS, “significantly improves security over password-only systems”, but that SMS, email one-time passcodes and authenticator apps “are prone to remote phishing attacks”. ASD describes SMS messages and voice calls as “weaker multi-factor authentication implementations” because telecommunication networks don’t provide end-to-end security. Phishing-resistant and phishing-prone methods quotes both.

Is Microsoft Authenticator phishing-resistant?

It depends on how it’s used. Microsoft lists passkeys in Microsoft Authenticator as phishing-resistant, but describes authenticator apps used for push notifications or codes as prone to remote phishing. Microsoft states that number matching is enabled for all Authenticator push notifications and that users can’t opt out of it. How the common methods compare shows each Authenticator option and how Microsoft classifies it.

How do I require phishing-resistant MFA for admins in Microsoft 365?

Microsoft publishes a Conditional Access policy for this. Under Entra ID > Conditional Access > Policies, it includes administrator roles, excludes emergency access accounts, and grants access with Require authentication strength set to Phishing-resistant MFA strength, starting in Report-only mode. Microsoft says Conditional Access needs Microsoft Entra ID P1. Require phishing-resistant MFA for admins has the steps.

Is MFA mandatory for Microsoft 365 admin accounts?

Microsoft’s mandatory MFA documentation states that MFA is required for accounts signing in to the Azure portal, the Microsoft Entra admin center and the Microsoft Intune admin center, with enforcement for the Microsoft 365 admin center gradually beginning from February 2025. Microsoft adds that emergency access accounts are also required to sign in with MFA. Where official guidance places emphasis names the methods Microsoft says satisfy the requirement.

What do I do if someone loses their phone or security key?

Microsoft describes a Temporary Access Pass, “a time-limited passcode”, that lets a user sign in and set up another passwordless method after losing one. Microsoft’s TAP page notes that users who update methods after losing a device should remove the old methods. ASD’s passkeys guidance recommends a backup passkey on a second FIDO2 security key. Lost or replaced devices has both sources.

Related guides

• Security defaults vs Conditional Access
• Passkeys explained for everyday users
• Hardware security keys: what they are and how they differ