When I review tenants, I now expect to see phishing-resistant MFA for admins. Regular users, though, still mostly sign in with the classic Authenticator app, and sometimes even with SMS. The real problems start when you extend strong MFA to everyone. You're dealing with many device types, shared accounts, frontline scenarios, legacy app dependencies and whatever hardware happens to be out there. A practical, tenant-wide rollout in Entra ID doesn't come down to one technology. You have to orchestrate several methods and onboarding flows, and you have to keep tracking where you stand.

Several methods together make up phishing-resistant MFA

The goal itself is simple. Every cloud sign-in that could reach sensitive data or privileged functions should require a phishing-resistant MFA method. Microsoft's documentation covers the basics, but in practice you'll end up combining several options:

  • Windows Hello for Business with cloud Kerberos trust for managed Windows endpoints (more on this here)
  • Passkeys in Microsoft Authenticator for mobile, BYOD and cross-device sign-in (my passkeys post)
  • FIDO2 security keys for shared workstations and shared frontline accounts
  • macOS Platform SSO with Entra ID integration for managed Macs (my setup experience)
  • Temporary Access Pass for secure onboarding and recovery (how the onboarding works)

All of these can be enforced or allowed for specific user groups through authentication strength policies (the concept explained). The key is to match your policy and onboarding to what each group can actually use. Dogmatic all-or-nothing enforcement tends to produce shadow IT and frustrated users.

Authentication strengths are the real control lever

With authentication strength policies in Entra ID you decide which MFA methods count for which users, apps or roles, and that makes a big difference in practice. For admins and sensitive resources I usually create custom authentication strengths that accept only Windows Hello, passkeys and FIDO2. Standard knowledge workers on managed devices are mostly covered by passkeys and Hello. In frontline and shared scenarios, FIDO2 keys are often the most sensible choice.

Conditional Access is what enforces these strengths. So you can check the impact safely with report-only mode or exclusions before you make anything mandatory. For the admin side of this, see my blog post on authentication strengths.

The diagram below shows a practical onboarding and assignment flow:

flowchart TD
    onboarding["Onboard with Temporary Access Pass"] --> winhello["Windows Hello for Business"]
    onboarding --> passkey["Passkey in Authenticator"]
    onboarding --> fido2["Register FIDO2 key"]
    onboarding --> macsso["macOS Platform SSO"]
    winhello --> group1["Office staff on Windows"]
    passkey --> group2["Mobile & BYOD"]
    fido2 --> group3["Frontline & Shared"]
    macsso --> group4["macOS users"]
    allmethods["Authentication strength policy"] --> group1
    allmethods --> group2
    allmethods --> group3
    allmethods --> group4

Figure: MFA onboarding and enforcement per user group, controlled by authentication strength policies.

Shared accounts, frontline staff and recovery need special handling

Shared workstations, frontline terminals and labs always push the limits. Windows Hello doesn't work there, because biometrics can't be shared. I've had the best results handing out FIDO2 keys to small groups, for example one key per counter or per shift, tracked as a physical asset. The most important piece is onboarding with Temporary Access Pass (TAP). It lets you bring new or reset accounts online with phishing-resistant MFA without ever issuing a weak starter password or falling back to SMS (step-by-step guide).

Shared service or functional accounts remain a stumbling block. Retire them where you can, or replace them with personal accounts and delegated permissions. Entra ID workload identities now offer more modern and secure options here (my post on workload identities).

Practical tip: For frontline and shared scenarios, order a pool of FIDO2 keys in advance, track them in your asset management system and handle them the same way you handle laptops or badges. Rollouts go much more smoothly, and so does dealing with lost keys.

Onboarding, training and user buy-in matter most

A good technical plan can still fail because of poor onboarding. Don't simply "flip the switch" on MFA for everyone, or the helpdesk tickets will bury you. Phased rollouts have worked best for me: IT first, then early adopters, then the wider workforce step by step. Temporary Access Pass is the central tool for phishing-resistant setup and recovery, especially for remote users. Short video demos and clear instructions cut down on confusion. Your support team also needs to cover both sides, the technical one (registration, troubleshooting, secure resets) and the human one (calm, concise communication).

Regular measurement shows how phishing-resistant your tenant really is

The best dashboard is under Entra ID → Authentication methods → User registration details. It shows how many users have registered a phishing-resistant method. Keep in mind that these numbers reflect what's registered, not what's actually required. For an accurate picture of your critical groups, review Conditional Access reports regularly and run What-If policy tests. If you have Entra ID P1/P2 licences and diagnostic logs in place, you can go further in Log Analytics (see this post) and analyze which sign-in methods are really being used.

I track rollout KPIs the same way, for example "80% of office staff using passkeys or Hello by month-end". Only regular measurement shows you the gaps, the blockers and the outlier groups where onboarding or training needs an extra push.

There is no silver bullet, but there is a practical path

Getting phishing-resistant MFA to every user won't happen quickly. It's an ongoing mix of technology, process, training and support. Turning on the technology is the easy part, while adoption and recovery support take the real effort. My advice is to start with your most critical groups, get onboarding and recovery right, and keep measuring. Don't wait for a perfect solution that covers every edge case, because it won't come. If you phase, measure and adjust as you go, your tenant will hold up against modern phishing, and you'll have laid the groundwork for going passwordless.