Phishing-resistant MFA
noun · also Phishing-resistant authentication · NIST SP 800-63B
Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.
Most MFA methods can be phished in some way: a one-time code can be typed into a fake page, and a push notification can be approved by a user who was tricked. Phishing-resistant methods close that gap with public-key cryptography bound to the real website's origin. The browser and the authenticator check which site is asking, so a lookalike domain simply gets nothing usable.
Passkeys, FIDO2 security keys, Windows Hello for Business and certificate-based authentication are the common phishing-resistant options in Microsoft environments.
Example
An administrator clicks a convincing phishing link and lands on a proxy that relays the real sign-in page. They try to sign in with their security key, but the key is registered for the genuine domain and refuses to authenticate for the proxy. The attack ends there.
Why it matters for a SOC analyst
When you write recommendations after an identity incident, phishing-resistant MFA for administrators and other high-value accounts is usually the single most effective change. In Entra ID, Conditional Access authentication strengths let you require it for specific users or apps.
Articles that use this term
Threat Analysis · · 4 min read
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Related terms
- Multi-factor authentication
Signing in with two or more different kinds of proof, such as a password plus a phone or security key, so a stolen password alone is not enough.
- Adversary-in-the-middle phishing
Phishing that relays the victim's sign-in to the real site through an attacker's proxy, stealing the session cookie after MFA succeeds.
- MFA fatigue
An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.