Passkeys have become a major topic in identity security, particularly as Microsoft and other major technology providers continue moving away from traditional authentication methods like SMS and email-based MFA.

For organizations looking to improve their security posture, passkeys offer an attractive alternative. They provide strong phishing resistance, reduce reliance on passwords, and can be deployed without the operational overhead of a traditional enterprise PKI.

However, there's a common misconception that passkeys are simply another form of multifactor authentication, offering little improvement over existing solutions like Microsoft Authenticator.

To understand why this isn't the case, we need to look beyond the user experience and examine how authentication actually works.

The distinction isn't just how many factors are involved. It's how trust is established, how credentials are protected, and whether an attacker can intercept and reuse the authentication process.

Understanding Traditional MFA

Traditional MFA generally works by requiring a user to provide an additional factor after entering their credentials.

Depending on the implementation, this might involve:

• Receiving a one-time code through SMS or email.
• Entering a time-based one-time password (TOTP).
• Approving a push notification.
• Matching a number displayed during authentication.
• Using a hardware token to generate a temporary code.

These methods provide meaningful security improvements over passwords alone. However, they share an important limitation: many rely on information or approval that can be relayed between a legitimate service and an attacker.

Let's examine some of the most common implementations.

SMS and Email MFA

SMS and email-based authentication are among the weakest forms of MFA.

SMS is susceptible to SIM swapping, interception, and social engineering. Email codes can be compromised through mailbox access, phishing, or attacks against the email account itself.

The problem isn't that these methods provide no security. It's that the additional factor can often be obtained or manipulated by an attacker.

Hardware OTP Tokens

Hardware tokens, such as traditional RSA SecurID devices, provide a separate possession factor and remain useful in certain environments.

However, OTP-based hardware tokens aren't inherently phishing-resistant.

If an attacker captures a valid one-time code and relays it to the legitimate service before it expires, authentication may succeed.

Their primary advantages are physical separation from the user's computer and the ability to operate independently of a mobile application. Their disadvantages include procurement costs, distribution, replacement, and lifecycle management.

Software-Based MFA

Applications like Microsoft Authenticator have significantly improved the usability and security of MFA.

They support several authentication methods, including:

• TOTP codes.
• Push notifications.
• Number matching.
• Passwordless authentication.

Number matching, in particular, helps mitigate MFA fatigue attacks by requiring users to match a challenge displayed during sign-in.

However, these improvements don't eliminate all phishing risks.

The Adversary-in-the-Middle Problem

One of the most significant threats to traditional authentication is the adversary-in-the-middle (AiTM) attack.

In a typical AiTM scenario, an attacker establishes a reverse proxy between a victim and a legitimate authentication service.

The process looks something like this:

1. The victim navigates to a convincing phishing page.
2. The attacker proxies the victim's credentials to the legitimate service.
3. The legitimate service issues an MFA challenge.
4. The attacker relays that challenge to the victim.
5. The victim completes authentication, believing they're interacting with the real service.
6. The attacker captures the resulting authenticated session.

The attacker doesn't necessarily need to defeat MFA. They simply relay the authentication process and steal the resulting session.

This is particularly dangerous because the victim may have successfully completed every authentication step required by the legitimate service.

TOTP codes are vulnerable to real-time interception, and push-based authentication can be abused through convincing social engineering or relay techniques.

Number matching makes these attacks more difficult, but it doesn't establish cryptographic trust between the authenticator and the legitimate domain.

This is where passkeys fundamentally change the equation.

How Passkeys Actually Work

Passkeys are based on public key cryptography, using standards developed through the FIDO Alliance and implemented through WebAuthn and related protocols.

Instead of relying on a shared secret, such as a password or OTP, passkeys use a cryptographic key pair.

When a user registers a passkey with a service:

1. The authenticator generates a public and private key pair.
2. The private key is securely stored by the authenticator.
3. The public key is registered with the service.
4. The service associates that public key with the user's account.

During authentication, the service generates a cryptographic challenge.

The authenticator signs that challenge using the private key, and the service verifies the signature using the registered public key.

The private key is never sent to the service.

This is already a significant improvement over password-based authentication, but the most important security property is something else entirely.

Origin Binding

Passkeys are cryptographically bound to the legitimate origin (domain) for which they were created.

When a user attempts to authenticate, the browser and authenticator validate the origin against the credential's registered relying party.

Consider an example:

A user has registered a passkey for login.microsoftonline.com.

An attacker creates a convincing phishing page that looks identical to the Microsoft sign-in experience but is hosted on a different domain.

When the user attempts to authenticate, the authenticator recognizes that the origin doesn't match the registered credential.

The passkey cannot simply be used on the attacker's domain.

This is the critical difference between passkeys and traditional MFA.

There is no OTP for the attacker to intercept, no push notification to relay, and no password to capture. The authentication process is tied to the legitimate service through cryptographic verification.

Even a convincing phishing page cannot change that relationship.

Are All Passkeys the Same?

No. Understanding the distinction between device-bound and synced passkeys is important, particularly for organizations with strict security requirements.

Device-Bound Passkeys

Device-bound passkeys keep the private key tied to a specific authenticator or device.

Depending on the platform, the key may be protected by hardware-backed security mechanisms such as:

• A Trusted Platform Module (TPM).
• Apple's Secure Enclave.
• Android's hardware-backed Keystore.
• A dedicated FIDO2 security key.

These mechanisms help protect private keys from extraction and unauthorized use.

Device-bound credentials are particularly attractive in managed enterprise environments because they provide stronger control over where credentials can exist.

Synced Passkeys

Synced passkeys allow credentials to be securely synchronized across devices through a passkey provider.

This improves usability and reduces the risk of users losing access when replacing a device.

Importantly, synced passkeys remain phishing-resistant. Synchronization does not eliminate the origin-binding properties of the underlying authentication protocol.

However, synchronization introduces additional considerations around account recovery, provider security, and credential availability across devices.

For organizations with stringent requirements, device-bound credentials may be preferable because they provide greater control over credential storage and portability.

Does a Passkey Satisfy Multifactor Authentication?

This is another area where the terminology can be confusing.

A passkey can satisfy multifactor authentication through a combination of possession and local user verification.

For example:

• Something you have: The device or security key holding the private key.
• Something you know: A PIN used to unlock the authenticator.
• Something you are: A biometric verification, such as a fingerprint or facial recognition.

The user doesn't necessarily need to complete separate authentication prompts for these factors.

A single passkey authentication can provide strong multifactor security because the authenticator verifies the user's presence or identity before allowing the cryptographic operation.

This is why passkeys can improve security while simultaneously reducing friction for users.

One important caveat: a security key's possession alone is not equivalent to multifactor authentication. Where required, user verification must be enforced through an appropriate PIN or biometric mechanism.

What About Microsoft Entra ID?

For organizations using Microsoft Entra ID, passkeys can be integrated into an existing identity security strategy.

Administrators can configure authentication methods, establish authentication strengths, and use Conditional Access to require appropriate authentication for sensitive applications and resources.

A practical deployment might include:

1. Enabling FIDO2 security keys or supported passkey methods.
2. Establishing registration and recovery procedures.
3. Requiring appropriate user verification.
4. Configuring Conditional Access authentication strengths.
5. Piloting deployment with a controlled group.
6. Monitoring authentication activity and adoption.
7. Expanding deployment based on user readiness and security requirements.

Organizations should also consider the distinction between device-bound and synced credentials when defining their authentication policies.

Passkeys aren't a replacement for a comprehensive identity security strategy. Device compliance, endpoint protection, session controls, privileged access management, and recovery processes remain essential.

Are Passkeys Completely Phishing-Proof?

No authentication method is entirely immune to compromise.

Passkeys significantly reduce the risk of credential phishing and AiTM attacks, but they don't eliminate threats involving compromised endpoints, malicious software, account recovery weaknesses, or compromised identity providers.

An attacker who controls a user's endpoint may be able to interact with an authenticator or steal an authenticated session through mechanisms that don't require defeating the passkey itself.

Similarly, weak account recovery processes can undermine even the strongest primary authentication method.

The objective isn't to find a single technology that solves every security problem. It's to eliminate entire classes of attacks wherever possible.

Passkeys accomplish this exceptionally well for credential phishing.

The Case for Hardware-Backed Authentication

For organizations looking to move beyond traditional MFA, hardware-backed FIDO2 credentials are an excellent option.

They offer:

• Strong phishing resistance through origin binding.
• Private key protection through secure hardware.
• Resistance to credential replay and OTP interception.
• Support for multifactor authentication through user verification.
• Reduced reliance on passwords and traditional PKI infrastructure.

Solutions such as YubiKey provide a practical way to introduce these capabilities without building and maintaining an enterprise certificate infrastructure.

They aren't the only option, and the right implementation depends on the organization's threat model, device ecosystem, and operational requirements.

But for environments where authentication security is a priority, they're worth serious consideration.

Final Thoughts

The conversation around passkeys shouldn't focus solely on whether they're more convenient than traditional MFA.

The real improvement is architectural.

Traditional MFA often adds another step to an authentication process that can still be intercepted. Passkeys change the authentication process itself by establishing cryptographic trust between the authenticator and the legitimate service.

That distinction is what makes them so valuable.

The future of authentication isn't about making users prove their identity more times. It's about making authentication fundamentally harder to compromise.