Phishing-resistant MFA (passkeys and FIDO2 security keys)

What it is

Most MFA still involves something a person can be tricked into handing over: a one-time code typed into a fake login page, or a push prompt approved without thinking. Attackers now run phishing pages that pass those codes straight through to the real site in real time.

Passkeys stop that. The FIDO Alliance defines a passkey as a sign-in credential based on FIDO standards. It uses public key cryptography: a private key stays on your phone, laptop or security key, and the website only ever holds the matching public key. Microsoft explains that the key pair is bound to the site it was created for, so a passkey simply won’t work on a look-alike domain. You unlock it the same way you unlock your device, with a fingerprint, face or PIN.

There are two kinds:

• Device-bound passkeys never leave one device. FIDO2 security keys and passkeys in Microsoft Authenticator are examples.
• Synced passkeys are copied between your devices by a provider such as Apple or Google.

The NCSC puts FIDO2 at the top of its list of MFA methods, saying it gives guessing, phishing and theft resistance. It notes that push-approval apps only give partial phishing resistance because of “prompt fatigue” attacks, where someone is bombarded with requests until they approve one.

Why it matters for a UK small or regulated business

Administrator accounts and staff who approve payments are the most valuable targets. A phished admin account can change anything in your tenant. Phishing-resistant sign-in for those people closes the gap that ordinary codes and prompts leave.

How it works in Microsoft 365

Microsoft Entra ID supports passkeys and FIDO2 security keys as sign-in methods. Microsoft recommends FIDO2 security keys for highly regulated industries and users with elevated privileges, with passkeys in Microsoft Authenticator as an alternative. On Business Premium, a Conditional Access policy can require a phishing-resistant “authentication strength” for admin roles.

How &DEV helps: our cyber assurance uplift for regulated firms sets up security keys or passkeys for admins and the people who handle client money.