Phishing-Resistant MFA: A Practical Guide for Australia

You turned on multi-factor authentication years ago, so your accounts should be safe. Unfortunately, attackers have adapted. Many of today’s account takeovers happen to users who did have MFA switched on, because the attacker tricked them into handing over the code or approving the login. That is why phishing-resistant MFA has moved from a nice-to-have to a core security control, and why it now sits inside Australia’s Essential Eight maturity model.

This guide explains what phishing-resistant MFA is, which methods qualify and which don’t, what the Essential Eight expects, and a practical step-by-step plan to roll it out in a Microsoft 365 environment without chaos.

Quick Answer: What Is Phishing-Resistant MFA?

Phishing-resistant MFA is a sign-in method that cannot be tricked into working on a fake website. It uses cryptographic proof tied to the real site’s address, so even if a user is fooled into clicking a convincing phishing link, there is no code to steal and no approval to hijack. The most common examples are FIDO2 security keys, passkeys, Windows Hello for Business and smart cards or certificates.

Key Takeaways

• Standard MFA such as SMS codes, email codes and basic app approvals can be bypassed by phishing, SIM swapping and MFA fatigue attacks.
• Phishing-resistant MFA binds the login to the genuine website, so stolen credentials or codes are useless to an attacker.
• Under the Essential Eight, phishing-resistant MFA is expected from Maturity Level Two for online services and systems, with more coverage at Maturity Level Three.
• You can start with administrators and high-risk staff, then expand to everyone.
• It reduces risk sharply but does not replace email security, endpoint protection and staff awareness.

Why Standard MFA Is No Longer Enough

MFA still blocks a huge share of automated attacks, and you should never turn it off. But attackers have developed reliable ways around the weaker versions.

• Adversary-in-the-middle (AiTM) phishing. The victim lands on a fake login page that quietly relays everything to the real one. The user enters their password and MFA code, the attacker captures the session, and walks in as the user, often without ever needing the password again.
• MFA fatigue (push bombing). Attackers trigger repeated approval prompts until a tired or confused user taps “Approve”.
• SIM swapping and SMS interception. Codes sent by text can be redirected to an attacker’s device.
• Social engineering. A caller posing as IT asks the user to read out a one-time code “to verify your identity”.
• Session and token theft. Once a session token is stolen, the attacker can bypass the login prompt altogether.

The common thread is that the user has to do something that can be tricked: type a code, approve a prompt or read a number. Phishing-resistant methods remove that weakness.

How Phishing-Resistant MFA Works

Phishing-resistant authentication relies on public key cryptography, the approach behind the FIDO2 and WebAuthn standards:

1. When you register a security key, passkey or Windows Hello credential, your device creates a key pair. The public key goes to the service. The private key never leaves your device.
2. At sign-in, the service sends a challenge that your device signs with the private key, after you unlock it with a PIN or biometric.
3. The credential is bound to the real website’s domain. If you are on a look-alike phishing site, the device simply won’t respond, because the domain doesn’t match.

There is no shared secret to type, no code to read out and no approval to trick. The login only works on the genuine site, on the genuine device, with the genuine user present.

Which MFA Methods Are Phishing-Resistant?

Some guides describe number-matching push notifications as phishing-resistant. They are a worthwhile improvement over simple approvals, but they are not tied to the legitimate website, so most frameworks, including Microsoft’s authentication strength categories, don’t treat them as phishing-resistant. When in doubt, check the current guidance from the Australian Signals Directorate.

Phishing-Resistant MFA and the Essential Eight

The Essential Eight is the Australian Government’s baseline set of mitigation strategies, published by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. Multi-factor authentication is one of the eight strategies, and the November 2023 update to the maturity model strengthened its expectations.

In simplified terms:

The exact wording changes between releases, so treat this table as a guide and check the current Essential Eight maturity model for the controls that apply to you. Microsoft also publishes Essential Eight MFA guidance showing how the requirements map to the Microsoft identity platform.

Who Needs to Comply?

Federal government entities subject to the PSPF are expected to reach at least Maturity Level Two. Private businesses are not generally forced by law to follow the Essential Eight, but it is increasingly the yardstick used by:

• Clients and tenders that ask suppliers to show their security posture.
• Cyber insurers who ask detailed MFA questions on proposal forms.
• Boards and auditors looking for a recognised framework.
• Supply chains where one weak supplier puts everyone at risk.

If you want to know where you stand, our Microsoft 365 security assessment and cyber health check are practical starting points.

Which Option Fits Your Business?

There is no single best method. Match the technology to the user and the risk.

Most small and mid-sized businesses end up with a mix: security keys for admins, Windows Hello for office staff and passkeys for mobile.

How to Implement Phishing-Resistant MFA: 8 Steps

The steps below assume Microsoft 365 and Microsoft Entra ID, which most Australian SMEs use, but the same logic applies to other identity platforms.

Step 1: Audit Your Current Sign-In Methods

List every user, application and sign-in method. Find out who still relies on SMS or email codes, which accounts have no MFA at all, and which old applications use legacy authentication. Look for shared accounts, service accounts and admin accounts with weak protection.

Step 2: Prioritise by Risk

Start with the accounts that would hurt most if compromised: global admins, finance, executives, HR and anyone with access to sensitive data. Work outward from there.

Step 3: Choose Methods for Each User Group

Use the table above to decide between security keys, Windows Hello and passkeys. Check device compatibility, since older phones and laptops may not support every option.

Step 4: Pilot With a Small Group

Roll out to IT staff and a handful of willing users first. Test registration, sign-in on different devices, lost-device recovery and compatibility with your key applications.

Step 5: Register Authenticators Securely

The registration step is a target for attackers, so protect it. In Entra ID, a Temporary Access Pass can let a verified user register a passkey or security key safely. Require identity verification, not just a helpdesk phone call, before issuing one.

Step 6: Enforce It With Conditional Access

Use Microsoft Entra ID Conditional Access with authentication strengths to require phishing-resistant methods for admins, sensitive apps and risky sign-ins. Keep one or two tightly controlled emergency accounts, stored securely and monitored, so a policy mistake can’t lock you out.

Step 7: Retire the Weak Methods

Once users are enrolled, remove SMS, email codes and basic approvals for the groups you have moved. Block legacy authentication protocols that can bypass MFA entirely. If weak methods remain as fallbacks, attackers will simply request them.

Step 8: Log, Monitor and Review

Centrally log sign-in and MFA events, as the Essential Eight expects at higher maturity levels, and alert on unusual activity such as impossible travel, new device registrations and repeated failures. A security operations centre or monitored service helps turn those logs into action.

Common Challenges (and How to Solve Them)

• “What if someone loses their key?” Issue two keys per admin and keep a documented, identity-verified recovery process.
• “Our older apps don’t support it.” Put those apps behind modern authentication where possible, restrict access, or plan to replace them. Don’t leave them as a back door.
• “Contractors and BYOD are messy.” Use Conditional Access to limit what unmanaged devices can reach, and give contractors passkeys or keys where feasible.
• “It will cost too much.” Security keys cost far less than a single incident. Many staff can use Windows Hello or passkeys on devices they already have.
• “Users will push back.” Passkeys and Windows Hello are often faster than typing a password and code. Communicate the benefit and offer short training.
• “Shared accounts.” Replace them with named accounts. Shared logins undermine both security and auditing.

Common Mistakes to Avoid

• Leaving weak fallback methods enabled. An attacker will target the weakest option available.
• Protecting only the login, not the registration. If anyone can add a new authenticator after a phishing attack, the control is bypassed.
• Skipping admins. Privileged accounts should be first, not last.
• Forgetting service accounts and legacy protocols. These often sit outside MFA entirely.
• No recovery plan. Lockouts create pressure to switch the control off.
• Treating it as a one-off project. Review enrolment, exceptions and logs regularly.

Phishing-Resistant MFA Is One Layer, Not the Whole Defence

Strong sign-in blocks a major attack path, but attackers also use malware, unpatched systems, malicious attachments and insider mistakes. Combine phishing-resistant MFA with:

• Email security to stop phishing messages reaching inboxes
• Microsoft Defender and endpoint protection to detect and contain threats
• Security awareness training so staff recognise suspicious requests
• Dark web monitoring to spot leaked credentials early
• Tested backups, patching and least-privilege access

This layered approach is what the Essential Eight is designed to encourage. If you want help building it, see our network security services.

Phishing-Resistant MFA Checklist

• Inventory of users, apps and sign-in methods completed
• Admin and high-risk accounts identified
• Methods chosen for each user group
• Backup authenticators and recovery process documented
• Secure registration process (such as Temporary Access Pass) in place
• Conditional Access policies enforcing phishing-resistant strength
• SMS, email and basic push methods removed for enrolled groups
• Legacy authentication blocked
• Emergency accounts secured and monitored
• MFA and sign-in events logged and reviewed
• Staff trained and helpdesk process updated

Frequently Asked Questions

What is phishing-resistant MFA?

It is multi-factor authentication that uses cryptographic credentials tied to the genuine website, so phishing pages, relayed codes and tricked approvals can’t be used to log in. Examples include FIDO2 security keys, passkeys, Windows Hello for Business and smart cards.

Is SMS or authenticator app MFA phishing-resistant?

No. SMS codes, email codes, authenticator app codes and standard push approvals can all be captured or abused through phishing, relay attacks or social engineering. They are still better than no MFA, but they are not phishing-resistant.

Are passkeys phishing-resistant?

Yes, passkeys are built on the same FIDO2 and WebAuthn standards and are bound to the legitimate site. Whether a passkey is stored on one device or synced across devices affects recovery and risk, so choose settings that match your security requirements.

Is phishing-resistant MFA required by the Essential Eight?

The maturity model expects phishing-resistant MFA from Maturity Level Two for online services and systems, with broader coverage at Level Three. Check the current ASD publication for the exact requirements, as wording is updated over time.

Does my small business need phishing-resistant MFA?

If you handle client data, financial transactions or use Microsoft 365, the answer is almost certainly yes, at least for administrators and high-risk staff. Attackers don’t ignore small businesses, and a single compromised mailbox can lead to fraud and data loss.

How much does it cost to implement?

Costs depend on how many users need hardware keys and how much setup support you need. Many organisations use built-in options such as Windows Hello for Business and passkeys, which avoid hardware costs, and buy security keys only for admins and shared devices.

Will it stop all phishing attacks?

No. It stops phishing from stealing your login, which is a major goal for attackers, but users can still be tricked into other harmful actions such as opening malware or approving fraudulent payments. That is why it works best alongside email security, endpoint protection and training.

Get Phishing-Resistant MFA Right the First Time

Phishing-resistant MFA is one of the most effective upgrades you can make to your security, and it is increasingly what clients, insurers and the Essential Eight expect. The key is to roll it out in order: protect admins first, choose methods that suit your users, enforce with Conditional Access and keep a recovery plan ready.

At Codehyper, we help Australian businesses assess their identity security, plan the rollout and manage it day to day, with services including cybersecurity for Western Sydney businesses. Contact our team to find out where your gaps are and what to fix first.