How to Configure Microsoft Entra ID Conditional Access Authentication Strengths for Phishing-Resistant MFA

For years, enabling Multi-Factor Authentication (MFA) was considered the gold standard for identity protection. However, modern threat actors have adapted. Advanced Adversary-in-the-Middle (AitM) attacks—using proxy tools like Evilginx2—can seamlessly intercept SMS passcodes, Voice call approvals, and even push notifications (via MFA fatigue attacks). The painful reality is that not all MFA is created equal.

To combat this, Microsoft introduced Authentication Strengths within Entra ID (formerly Azure AD) Conditional Access. Instead of a binary policy that simply demands “Require MFA,” administrators can now dictate the cryptographic quality of the MFA method based on the sensitivity of the resource being accessed.

This guide explains how to design and deploy Authentication Strengths to enforce strict, Phishing-Resistant MFA (like FIDO2 Security Keys) for privileged actions, while allowing standard MFA for low-risk access.

Understanding Authentication Strengths

Authentication Strengths is a feature that categorizes every authentication method into a hierarchy.

Microsoft provides three built-in tiers:

1. Multifactor Authentication: The weakest tier. Includes SMS, Voice calls, and legacy push notifications. Vulnerable to AitM and SIM swapping.
2. Passwordless MFA: Includes Windows Hello for Business and the Microsoft Authenticator App (configured for Passwordless phone sign-in). Highly secure, but technically still vulnerable to sophisticated AitM if the user is tricked into approving a rogue prompt.
3. Phishing-Resistant MFA: The highest tier. Includes FIDO2 Security Keys (YubiKeys) and Windows Hello for Business (when backed by a TPM hardware credential). These methods cryptographically bind the authentication attempt to the exact domain name (e.g., login.microsoftonline.com). If the user is on a fake phishing site (login.m1crosoft.com), the hardware token will refuse to generate a response.

Step 1: Creating a Custom Authentication Strength

While the built-in tiers are useful, enterprise environments often require custom tiers (for example, allowing FIDO2 keys but strictly banning Windows Hello for specific administrative accounts).

1. Navigate to the Microsoft Entra admin center (entra.microsoft.com).
2. Go to Protection > Authentication methods > Authentication strengths.
3. Click New authentication strength.
4. Name: Strict FIDO2 Only (Admins)
5. In the list of methods, uncheck everything except FIDO2 security key.
6. Click Next and Create.

Step 2: Enforcing Phishing-Resistant MFA via Conditional Access

The true power of Authentication Strengths is realized when applied dynamically via Conditional Access policies.

We will create a policy that mandates our newly created “Strict FIDO2 Only” strength whenever a user attempts to access the Azure Management Portal.

1. Go to Protection > Conditional Access > Policies.
2. Click New policy.
3. Name: Enforce Phishing-Resistant MFA for Azure Portal
4. Under Users, select your target administrative groups.
5. Under Target resources, select Select apps, and search for Microsoft Azure Management.

Step 3: Configuring the Grant Controls

Instead of the traditional “Require multifactor authentication” checkbox, you now select your specific strength.

1. Under Access controls, select Grant.
2. Check the box for Require authentication strength.
3. From the dropdown menu, select the custom strength you created in Step 1: Strict FIDO2 Only (Admins).
4. Click Select.

Enable the policy (starting in Report-only mode is recommended to gauge impact) and click Create.

Step 4: The End-User Experience

When an administrator navigates to portal.azure.com, Entra ID evaluates the policy. Even if the user just logged into their email 10 minutes ago using an SMS code (which satisfied a lower-tier policy for Office 365), Entra ID realizes that the Azure Portal requires a higher cryptographic standard.

The user will receive an interstitial prompt stating: “Your organization requires a stronger authentication method to access this resource.”

Entra ID will bypass SMS or Authenticator app options and explicitly prompt the user to insert and tap their FIDO2 Security Key. If the user does not possess a registered FIDO2 key, access is completely blocked.

Conclusion

The era of treating all MFA as equally secure is over. Adversaries have commercialized tools to bypass SMS and push notifications at scale. By deploying Microsoft Entra ID Authentication Strengths, identity architects can mathematically guarantee that access to mission-critical infrastructure is secured by Phishing-Resistant, hardware-bound cryptography, neutralizing AitM attacks entirely.