Require Phishing-Resistant MFA for Administrators

Administrator accounts are among the highest-value targets in an organization. Traditional MFA methods such as SMS, voice calls, and push notifications provide additional protection but can still be vulnerable to phishing, MFA fatigue, and adversary-in-the-middle attacks.

Require phishing-resistant MFA for privileged administrators using Microsoft Entra Conditional Access. Phishing-resistant authentication uses cryptographic authentication tied to the legitimate service, making stolen passwords or intercepted MFA codes insufficient for account compromise.

Recommended implementation

• Identify all accounts assigned privileged Microsoft Entra administrator roles.
• Enable appropriate phishing-resistant authentication methods such as FIDO2 security keys, passkeys, Windows Hello for Business, or certificate-based authentication.
• Ensure administrators register a phishing-resistant authentication method before enforcing the policy.
• Create a dedicated Conditional Access policy for privileged administrator roles.
• Target all resources so the requirement applies consistently across Microsoft cloud services.
• Under Grant controls, select Require authentication strength and choose Phishing-resistant MFA.
• Exclude designated emergency access (break-glass) accounts to prevent tenant lockout.
• Enable the policy in Report-only mode first and review Conditional Access sign-in results.
• After validating administrator access and authentication methods, change the policy from Report-only to On.

Recommended scope

At minimum, apply the policy to highly privileged roles such as Global Administrator, Privileged Role Administrator, Conditional Access Administrator, Security Administrator, Authentication Administrator, Privileged Authentication Administrator, Exchange Administrator, SharePoint Administrator, Application Administrator, and Cloud Application Administrator.

Avoid immediately enabling the policy without confirming authentication method registration. Administrators who do not already have an accepted phishing-resistant method may be unable to satisfy the Conditional Access requirement.