Microsoft Entra MFA Deep-Dive Guide: Method Selection, Conditional Access, Number Matching & Phishing-Resistant MFA

Microsoft Entra Multi-Factor Authentication (MFA) requires users to present a password plus an additional factor (mobile app, SMS, voice call, FIDO2 key, etc.) at sign-in. According to Microsoft's own statistics, enforcing MFA blocks 99.9% of account compromise attacks, making it the single most important authentication control for modern enterprises. MFA can be enforced via Conditional Access on Microsoft Entra ID Premium P1 or higher, or for free via Security Defaults on any Microsoft 365 plan (basic only). Microsoft has enforced MFA on all Azure tenant admin roles since 2024, and has announced phased enforcement for all users starting 2025. This article covers MFA authentication method selection, phased rollout, and operational patterns end to end.

Microsoft Entra MFA supports the following methods (in order of recommendation): 1) Microsoft Authenticator (push notifications + number matching — top choice, free, most widely adopted), 2) FIDO2 security keys (YubiKey-class hardware tokens — highest security, ideal for privileged roles), 3) Windows Hello for Business (biometrics + TPM — for Windows users), 4) Temporary Access Pass (TAP — one-time codes for onboarding), 5) Certificate-based Authentication (CBA — smart cards, common in government), 6) OATH software tokens (RFC 6238 TOTP — works with third-party authenticator apps), 7) OATH hardware tokens (physical TOTP devices), 8) Voice call (legacy phone OTP), 9) SMS text (vulnerable to SIM swap attacks — recommended for retirement), 10) Security questions (SSPR only). New projects should standardize on Microsoft Authenticator + FIDO2 and plan a phased retirement of SMS and voice.

Enforcing MFA through Conditional Access is the standard implementation pattern. Typical policies: 1) "All users -> all cloud apps -> Grant access with MFA" (org-wide MFA enforcement), 2) "Admin roles -> all apps -> MFA + compliant device" (privileged access hardening), 3) "Sensitive SharePoint site -> MFA + sign-in frequency of 1 hour" (high-security apps), 4) "Risky sign-in (Identity Protection) -> MFA re-authentication" (risk-based), 5) "Untrusted country -> MFA + compliant device" (geo-based). Authentication Strength lets you precisely control MFA grade (Phishing-resistant MFA = FIDO2 + Windows Hello only, Passwordless MFA, or all Multi-factor methods). In production, the modern best practice is to layer Authentication Strength: "Phishing-resistant MFA for privileged roles, Authenticator MFA for everyone else."

Per-user MFA (legacy): MFA is enabled/disabled per user as a flag, applied uniformly across all apps, with far less flexibility than Conditional Access. Microsoft is phasing it out — new tenants no longer surface it as of 2024. Conditional Access MFA (recommended): policy-based, with granular control by app, location, device, and risk. Requires Microsoft Entra ID Premium P1 or higher, supports fine-grained control via Authentication Strength, and is the modern standard. Decision: with a Microsoft Entra ID P1 license, Conditional Access MFA is the only sensible choice; on Free or Office 365 only, use Security Defaults (basic MFA enforcement + Legacy Auth block, free). Migrating existing Per-user MFA to Conditional Access MFA is recommended, and Microsoft's official Migration Wizard semi-automates the process.

Security Defaults is a free MFA enforcement feature (introduced 2019) available on every plan, including Microsoft Entra ID Free. It applies Microsoft's recommended baseline security settings to the entire organization with a single click: 1) Forces all users to register for MFA (Microsoft Authenticator within 14 days), 2) Requires MFA for privileged actions (Azure portal access, admin operations), 3) Blocks legacy authentication (POP/IMAP/SMTP), 4) Enforces MFA on all admin roles. New tenants have Security Defaults enabled by default, providing free baseline security. Constraints: 1) Cannot be used alongside Conditional Access (enabling Conditional Access automatically disables Security Defaults), 2) Not customizable, 3) Cannot exclude specific apps or users. The recommended pattern is to upgrade to Microsoft Entra ID P1 or higher and migrate to Conditional Access.

MFA fatigue (also called MFA bombing) is a social-engineering attack where attackers, armed with a compromised password, flood the user with push notifications until the user accepts one out of exhaustion. Typical defenses: 1) Enforce number matching (standardized in Microsoft Authenticator since 2023 — users must type a 2-digit number from the web page into the app rather than tapping a generic Yes), 2) Show additional context (location, app, and IP of the sign-in surface in Authenticator so users can spot suspicious attempts), 3) Limit MFA attempts (Smart Lockout blocks bulk attempts), 4) Use Identity Protection to detect risky sign-ins and block on MFA failure, 5) Apply risk-based Conditional Access to require phishing-resistant MFA (FIDO2) on risky sign-ins, 6) Train users to never approve unexpected MFA prompts. Microsoft has enforced number matching tenant-wide since May 2023, drastically reducing the effectiveness of MFA fatigue attacks.

Phishing-resistant MFA refers to methods that hold up against phishing attacks (fake sign-in pages designed to steal MFA codes). Microsoft-certified phishing-resistant methods are: 1) FIDO2 security keys (YubiKey, Feitian, etc.), 2) Windows Hello for Business (biometrics + TPM), 3) Certificate-based Authentication (CBA, PIV cards). These all use device-bound private keys — even if an attacker harvests an MFA response on a fake sign-in page, they cannot access the private key, so the attack fails. Phishing-vulnerable methods (Microsoft Authenticator push, SMS, voice, OATH tokens) can be defeated by Adversary-in-the-Middle (AiTM) attacks. Mandating phishing-resistant MFA via Authentication Strength provides the highest level of protection for privileged roles and sensitive data. US Executive Order 14028 (2021) required federal agencies to adopt phishing-resistant MFA by the end of 2024, and enterprises are following the same trend.

SC-300 (Identity and Access Administrator Associate) is the headline certification here, with MFA tested deeply in Domain 2 (Authentication, 25-30%). SC-100 (Cybersecurity Architect Expert) treats it as the core of the Identity pillar of Zero Trust strategy, MS-102 (Microsoft 365 Administrator Expert) Domain 2 covers organization-wide rollout, AZ-104 (Administrator) covers Entra ID fundamentals, AZ-305 (Solutions Architect Expert) addresses MFA from an architecture standpoint, and SC-200 (Security Operations Analyst) covers Identity Protection and MFA event analysis. MFA is required knowledge across the entire Microsoft security certification family, and the central technology of the Identity pillar of Zero Trust.