Phishing-Resistant Authentication: Deploying FIDO2 Passkeys & Conditional Access Auth Strength in M365

Adversary-in-the-Middle (AiTM) phishing frameworks such as Evilginx2, Modlishka, and M2M proxy toolkits have rendered traditional multi-factor authentication (SMS OTP, voice calls, TOTP authenticator apps, and standard push notifications) inadequate. AiTM proxies intercept real-time credentials and session cookies (such as ESTSAUTH and ESTSAUTHPERSISTENT), allowing attackers to bypass MFA seamlessly.

According to Microsoft Learn security specifications, eliminating AiTM phishing requires adopting Phishing-Resistant MFA. Powered by the W3C WebAuthn standard and FIDO2 Passkeys, this architecture cryptographically binds authentication assertions to the genuine domain origin (login.microsoftonline.com).

1. Threat Model: AiTM Phishing Proxy vs FIDO2 Domain Binding

2. Authentication Method Resilience Matrix

3. Automating Conditional Access Policy via Graph PowerShell SDK

To enforce Phishing-Resistant MFA across high-privilege administrators or all enterprise users, execute the PowerShell script below to create a targeted Conditional Access policy using Microsoft Entra Authentication Strengths.

# Connect to Microsoft Graph with Conditional Access Scopes
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess", "Policy.Read.All"

# Retrieve Built-in Phishing-Resistant Authentication Strength ID
$authStrength = Get-MgPolicyAuthenticationStrengthPolicy -Filter "displayName eq 'Phishing-resistant MFA'"

# Define Policy Properties
$policyParams = @{
    DisplayName = "CA001: Enforce Phishing-Resistant MFA for Admins"
    State = "enabledForReportingButNotEnforced" # Report-Only Test Mode
    Conditions = @{
        Applications = @{ IncludeApplications = @("All") }
        Users = @{ IncludeRoles = @("62e90394-69f5-4237-9190-012177145e10") } # Global Administrator
    }
    GrantControls = @{
        Operator = "OR"
        AuthenticationStrength = @{ Id = $authStrength.Id }
    }
}

Write-Host "Conditional Access Policy successfully configured with Phishing-Resistant Strength." -ForegroundColor Green

4. Step-by-Step Implementation Guide

1. Enable FIDO2 Method in Entra Portal: In Entra Admin Center → Protection → Authentication Methods → FIDO2 Security Key, set status to Enabled and target pilot security groups.
2. Enforce AAGUID Restrictions: Restrict hardware key registration to approved enterprise vendors (e.g. Yubico, Feitian) by entering allowed AAGUID lists in the FIDO2 method configuration.
3. Configure Temporary Access Pass (TAP): Enable TAP policies allowing single-use 1-hour passes for passwordless onboarding of new FIDO2 passkeys.
4. Deploy Conditional Access Auth Strength: Apply the Phishing-Resistant Authentication Strength policy created via PowerShell script above.

5. Auditing FIDO2 Passkey Registrations & Log Analytics KQL

To inspect FIDO2 key registration activities across your directory using Microsoft Graph PowerShell:

# Extract FIDO2 Security Key Registration Audit Events
Get-MgAuditLogDirectoryAudit -Filter "category eq 'UserManagement' and activityDisplayName eq 'User registered security key'" | 
    Select-Object ActivityDateTime, InitiatedBy, Result | Format-Table -AutoSize

To query FIDO2 sign-in success rates and detect fallback attempts in Azure Monitor / Log Analytics, run this KQL query:

// KQL Query: FIDO2 Passkey Sign-in Events vs Legacy MFA Fallbacks
SigninLogs
| where TimeGenerated > ago(7d)
| extend AuthenticationMethod = tostring(AuthenticationDetails[0].authenticationMethod)
| summarize Count = count() by AuthenticationMethod, ResultType, UserPrincipalName
| order by Count desc

6. Frequently Asked Questions (FAQ) - MSLearn Specifications

Q: Can users register FIDO2 passkeys stored in iOS Keychain or Google Password Manager?

Yes. Entra ID supports both hardware-bound security keys (YubiKey) and device-bound/synced passkeys (Apple Keychain / Google Password Manager), provided your AAGUID enforcement policy allows them.

Q: What is the recovery procedure if a user loses their FIDO2 security key?

Administrators generate a single-use Temporary Access Pass (TAP) valid for 1 hour. The user authenticates with the TAP and registers a replacement FIDO2 security key independently.

7. Conclusion

Enforcing Phishing-Resistant MFA via FIDO2 Passkeys neutralizes the single most dangerous threat vector facing enterprise identity systems. Integrating Authentication Strengths into Conditional Access guarantees zero compromised user sessions.