Shut these doors, in this order

Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.

Now · 5.5 hours

Next 30 days · 17 hours

Next 90 days · 7 hours

−1 exposure3 hoursIDN-009
Push notifications and codes can be relayed by a fake login page in real time, which is how most MFA-protected admin accounts are now taken over. Passkeys, FIDO2 keys and Windows Hello are bound to the real Microsoft sign-in page, so a phishing site cannot use them.
1. Give each administrator a passkey (Microsoft Authenticator or a FIDO2 security key) via https://aka.ms/mysecurityinfo.
2. Entra admin centre > Protection > Conditional Access > New policy: include the directory roles your admins hold.
3. Grant > Require authentication strength > 'Phishing-resistant MFA'. Exclude one break-glass account; report-only for a day, then On.
Authentication strengths need Entra ID P1 (included in Microsoft 365 Business Premium).
CompletesA.8.2A.8.5