Classic MFA is no longer always enough
MFA has greatly reduced account compromise, but not all methods are equal. SMS codes, poorly controlled push notifications and automatic approvals remain exposed to phishing, MFA fatigue and relay attacks (Adversary-in-the-Middle), which steal already authenticated sessions in real time.
Why the issue becomes urgent in 2026
Generative AI has changed the scale of phishing. Campaigns using AI-generated lures now reach a click rate of 54%, against 12% for traditional phishing. A single phishing-as-a-service platform, Tycoon 2FA, accounted on its own for 62% of the phishing volume blocked by Microsoft in mid-2025, specifically targeting classic MFA methods.
The key figures:
Click rate on AI-generated phishing: 54%.
Click rate on traditional phishing: 12%.
Share of the phishing blocked by Microsoft that came from a single platform (Tycoon 2FA): 62%.
Successful phishing attacks at Google after security keys were rolled out to 85,000 employees: zero.
Account takeovers at Snap after adopting FIDO2, over more than two years: zero.
Faced with this level of sophistication, the experience of large companies is unequivocal: Google recorded no successful phishing attack after deploying security keys to 85,000 employees, and Snap saw no account takeover for more than two years after adopting FIDO2. Cloudflare, for its part, withstood a sophisticated phishing campaign after deploying security keys and disabling every other MFA method.
FIDO2 passkeys provide stronger authentication: the user no longer types a reusable password, and authentication is bound to the legitimate service. Microsoft Entra ID lets you deploy these methods with targeted profiles and policies.
A threat growing faster than the defence
The latest Microsoft Digital Defense Report confirms the urgency: identity-based attacks rose by 32% in the first half of 2025, an increase largely attributed to attackers adopting generative AI to automate and personalise their campaigns. The good news is that Conditional Access, combined with phishing-resistant authentication, remains an effective barrier: by checking the device's state and the strength of the authentication before granting access, it blocks attempts that a simple stolen password, even with a code, used to let through.
Where to start
Protect administrator accounts first: Microsoft 365, Entra ID, Intune, security, backup and email administrators.
Choose the accepted methods: FIDO2 security keys, passkeys in Microsoft Authenticator, synced or device-bound passkeys; the choice depends on the level of risk and on usage.
Create a pilot group: test with a few volunteers and representative devices before extending.
Plan the fallback methods: a lost phone, a forgotten key or a new device needs a clear recovery process. This is critical, because an attacker always targets the weakest link, and an SMS recovery method left available can be enough to bypass the whole FIDO2 rollout, however robust it is otherwise.
Link it to Conditional Access: sensitive resources can require a higher authentication strength.
The link with activating privileged roles
Microsoft Entra ID now lets you require reauthentication through Conditional Access at the very moment a user activates a privileged role through Privileged Identity Management (PIM), rather than relying only on an existing session. In practice, an administrator who temporarily activates elevated rights must confirm their identity again with a strong method at that precise moment, which narrows the window of exploitation if their current session had already been compromised.
Common mistakes
Enabling a method without a support procedure.
Failing to distinguish admin accounts from standard accounts.
Forgetting service accounts and shared accounts.
Rolling out too fast without communicating with users.
Leaving weak methods available for sensitive accounts, which cancels much of the benefit of the rollout, exactly as the risk of bypass through a fallback SMS shows.
Hardware keys or synced passkeys
Not all passkeys are equal, and the right choice depends on the level of risk. Hardware security keys, the small devices you plug in or hold near the device, offer the strongest protection: the private key never leaves the hardware, which makes it almost impossible to steal remotely. They are the benchmark for the most critical accounts, starting with administrators.
Synced passkeys, stored in an ecosystem's keychain and available on all of a user's devices, offer a different trade-off: slightly less tamper-proof in theory, but far more practical, with no physical key to carry or replace if lost. For most standard users, they strike the best balance between security and simplicity. Many organisations combine the two: hardware keys for sensitive accounts, synced passkeys for everyone else.
What passkeys change day to day
Security is not the only argument, and it may not be the one that wins staff over. For users, a passkey mainly means the end of the password: nothing left to remember, type or renew every three months. Signing in takes a single gesture, a fingerprint, face recognition or the device PIN, often faster than typing a complex password.
This practical benefit is a powerful driver of adoption, provided the change is supported. Users accustomed to passwords may at first be wary of a method they do not fully understand; clear communication explaining what changes and why removes most of the reluctance. Once the step is taken, people rarely go back: the regained simplicity does more for adoption than any speech about phishing.
The password does not disappear overnight
Deploying passkeys does not mean removing every password the next day. In reality, the two coexist for a while: some older applications do not yet support FIDO2, technical accounts stay on classic mechanisms, and not all users switch at the same pace. That is normal, and trying to change everything at once is the surest way to block part of the business.
The right approach is gradual: make strong authentication mandatory where it matters most, privileged accounts first, then extend it as support and habits settle. The end goal is still to remove weak methods for sensitive accounts, but you get there in stages, without breaking what works.
A realistic path for a small business
Start with administrators, management and exposed accounts. Stabilise support, document how methods are registered, then extend to the most sensitive users. The aim is not to change everything in a week, but to reduce the risk quickly on the accounts that open the doors of the information system.
Protect the accounts that matter first
With phishing that AI makes more convincing every month, phishing-resistant authentication is no longer a luxury for large enterprises: it is the baseline protection for the accounts whose compromise opens the doors of the information system. The experience of Google, Snap and Cloudflare shows it: once the reusable password is replaced by a passkey bound to the legitimate service, a whole class of phishing attacks simply stops working.
This project naturally complements a Microsoft 365 and Intune setup and follow-up and an Active Directory audit. What matters is to start at the top, where a compromised account does the most damage, rather than wait for a big-bang switchover that never comes.
Sources: WorkOS, Passkeys stop phishing, your MFA fallbacks undo it · Microsoft Learn, FIDO2 passkeys in Microsoft Entra ID