Require phishing-resistant MFA for administrators¶
Licence and role
Microsoft Entra ID P1 (included in Microsoft 365 Business Premium, E3 and E5). Passkeys (FIDO2) are available in all editions.
Why it matters¶
Administrators are the target of adversary-in-the-middle phishing, which defeats SMS, voice and push. Microsoft recommends the built-in Phishing-resistant MFA strength (passkeys/FIDO2, Windows Hello for Business or platform credential, multifactor certificate-based authentication) for at least 14 admin roles, including Global, Security, Exchange, SharePoint, User, Helpdesk and Conditional Access Administrator.
Steps¶
- Run the read-only check: it lists policies that apply the phishing-resistant strength to directory roles and shows the methods each admin has registered.
- Make sure every admin has registered a passkey or Windows Hello for Business before you enforce (use a Temporary Access Pass to bootstrap).
- New policy: Users = Directory roles (Global, Application, Authentication, Billing, Cloud Application, Conditional Access, Exchange, Helpdesk, Password, Privileged Authentication, Privileged Role, Security, SharePoint and User Administrator); exclude EmergencyAccess.
- Target resources = All resources. Grant = Require authentication strength > Phishing-resistant MFA. Enable policy = Report-only, then On after the review.
Impact on users¶
Admins who have only SMS, voice or Authenticator push are blocked from admin sign-ins until they register a phishing-resistant method.
Rollback¶
Set the policy to Report-only or Off; issue a Temporary Access Pass to an admin who lost their key.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph PowerShell SDK (Microsoft.Graph.Identity.SignIns, .Reports, .Identity.DirectoryManagement).
Connect first:
Connect-MgGraph -Scopes Policy.Read.All,AuditLog.Read.All,UserAuthenticationMethod.Read.All,Directory.Read.All
Role: Global Reader or Security Reader is enough for these reads.
$p = Get-MgIdentityConditionalAccessPolicy -All
$a = $p | Where-Object { $_.Conditions.Users.IncludeRoles -and ($_.GrantControls.AuthenticationStrength.Id -eq '00000000-0000-0000-0000-000000000004' -or $_.GrantControls.AuthenticationStrength.DisplayName -like 'Phishing*') }
"Admin phishing-resistant policies: $(@($a).Count)"
$a | ForEach-Object { "$($_.DisplayName) | $($_.State) | roles: $(@($_.Conditions.Users.IncludeRoles).Count)" }
Get-MgReportAuthenticationMethodUserRegistrationDetail -All | Where-Object { $_.IsAdmin } | ForEach-Object { "Admin $($_.UserPrincipalName) | methods: $($_.MethodsRegistered -join ',')" }
How to verify¶
A policy with the Phishing-resistant MFA strength covers at least the 14 recommended roles and is On; every admin shows a passkey, FIDO2 or Windows Hello method.
Sources¶
- Policy admin phish resistant MFA (Microsoft Learn)
- Concept authentication strengths (Microsoft Learn)
This control is in the Conditional Access Baseline Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 20 controls.