FIDO2

FIDO2 is an open authentication standard from the FIDO Alliance, designed to replace passwords with strong cryptographic credentials that are phishing-resistant. A FIDO2 credential is a key pair generated on a device — typically a hardware security key (YubiKey, Feitian, Token2) or stored in the OS keychain as a passkey — that signs a challenge from the relying party (Entra ID). Microsoft Entra ID supports FIDO2 sign-in across web, Windows, Mac, iOS, and Android, including the WebAuthn browser API. Combined with Conditional Access, FIDO2 enables true passwordless sign-in for admins and high-risk users.

Why the cryptography defeats phishing specifically

The reason FIDO2 is described as phishing-resistant rather than merely "stronger MFA" comes down to what the credential actually signs. During registration, the private key is bound to the exact origin (domain) it was created against — Entra ID's real sign-in domain. At every subsequent sign-in, the browser or OS itself supplies the current page's origin to the authenticator as part of the challenge, and the signature only validates if that origin matches what was registered. A phishing site — no matter how convincing its visual copy of the real login page is, and even if it's actively relaying the user's password and one-time codes to the real site in real time — is running on a different domain, so the browser passes that different origin to the authenticator, the signature check fails, and the sign-in simply does not complete. This is a structural property of the protocol, not something that depends on the user noticing anything was wrong.

Worked example

An organisation is repeatedly targeted by adversary-in-the-middle phishing kits that proxy the genuine Microsoft sign-in page pixel-for-pixel and relay both password and MFA approval in real time — a technique that defeats SMS codes, one-time passcodes, and even standard push-approval MFA, because the user is genuinely typing their real credentials and approving a real (proxied) prompt. Admin accounts are issued FIDO2 hardware keys and a Conditional Access authentication strength policy requires phishing-resistant methods specifically for admin roles. When the same phishing kit is used against an admin, the fake page can capture whatever the admin types, but it cannot forward a valid FIDO2 assertion, because the admin's security key checks the browser-supplied origin against its registered origin, sees the phishing domain, and refuses to sign — the sign-in attempt simply fails at that step regardless of how convincingly the rest of the page was spoofed.

Roaming keys vs platform authenticators

FIDO2 credentials come in two forms. A roaming authenticator is a separate physical device (a USB or NFC security key) that can be carried between machines — useful for shared devices or for a user who signs in from multiple computers. A platform authenticator is built into the device itself (Windows Hello, Touch ID, a phone's biometric sensor) and doesn't roam between machines, which is simpler for a single-device user but means a lost or replaced device requires re-registering FIDO2 credentials on the new one.

Common pitfalls

Rollout typically stalls on two practical issues: recovery (what happens when a user loses their only security key — a break-glass secondary method or a documented re-registration process needs to exist before mandating FIDO2, not after the first lost key incident), and legacy client support (some older line-of-business apps and thick clients that use non-modern authentication libraries can't complete a WebAuthn challenge at all, forcing an exception process for those specific scenarios).