Multifactor authentication (MFA) is a significant improvement over passwords alone. But not every MFA method protects against the same attacks. A criminal who convinces someone to approve a sign-in or enter a temporary code on a fake website may still gain access.
That is why organisations are increasingly looking at phishing-resistant authentication. The phrase sounds technical; the business decision is fairly straightforward.
What makes one method different from another?
Text-message codes and app-generated one-time codes add a second step, but a convincing fake login page can sometimes collect the code while it is still valid. Push approvals are convenient, yet repeated prompts can lead to accidental approval.
Phishing-resistant approaches, such as appropriately configured FIDO2 security keys or passkeys, are designed to bind authentication to the legitimate service rather than letting a code be reused on a lookalike site.
That doesn’t remove every risk. A stolen, unlocked device or poorly managed account-recovery process still needs attention.
Who should go first?
You don’t have to move every account at once. Prioritise people whose accounts can cause broad disruption if compromised: tenant administrators, finance approvers, senior staff and users with access to sensitive customer information.
Then consider people who regularly work remotely or handle high volumes of external email. The right rollout order depends on your working practices, not just job titles.
Plan for ordinary problems
Before issuing security keys or enabling passkeys, answer a few questions:
- Can staff use the method on all their everyday devices?
- What happens when someone loses a phone or key?
- Is there a secure, documented recovery process?
- Do shared workstations or specialist applications need a different approach?
- Who supports people during enrolment?
A security change that blocks legitimate work will quickly lose support. Pilot with a small group and make the recovery process part of the test.
Don’t neglect the sign-in environment
Better MFA works best alongside fewer unnecessary administrator accounts, sensible access policies, device security and monitoring for unusual sign-ins. It is one layer of a wider plan.
For many small businesses, the immediate next step is not ordering dozens of security keys. It is checking which MFA methods are currently enabled, who has exceptions and whether critical accounts have stronger options available. Start there, then make a deliberate move toward phishing-resistant methods.
