Industry update· 4 Sept 2026
Not all MFA is equal: authenticator apps, passkeys, YubiKeys and biometrics compared
For a Cyber Essentials assessment, any of the methods below counts as MFA. But "counts" and "actually stops an attacker" aren't the same thing, and Microsoft has been explicit about the gap: its own Secure Future Initiative guidance states plainly that "traditional MFA methods such as SMS codes, email-based OTPs, and push notifications are becoming less effective against today's attackers," and that phishing-resistant MFA is now the baseline, not the exception.
The reason is real-time phishing: a fake login page that relays your code or push approval to the real site the instant you enter it, and MFA fatigue attacks, where an attacker floods your phone with approval requests until one gets tapped by accident. Both bypass SMS codes, one-time codes, and ordinary push notifications equally well. What stops them is a credential that's cryptographically tied to the real site's address, which is exactly what a fake page can't replicate.
Phishing-resistant MFA is now the baseline, not the exception.
The methods, briefly
- SMS or voice call codes. A code sent to your phone. Simple, but the code itself can be phished, and the phone number behind it can be SIM-swapped.
- Authenticator app (push or code). Apps like Microsoft Authenticator or Google Authenticator, used in their standard mode: approve a push or type a 6-digit code. Better than SMS (nothing to intercept over the phone network), but still just a code or approval a fake site can relay in real time.
- Passkeys. A cryptographic key pair generated on your device, unlocked by your device PIN or biometric, and bound to the specific website it was created for. The same authenticator app can generate one, so can your phone or laptop's built-in biometric system (this is what Windows Hello and Face ID/Touch ID are, when used to unlock a passkey rather than just your device).
- Hardware security keys (YubiKey and similar). A passkey on dedicated hardware instead of your phone or laptop. Same phishing-resistance, plus it works across devices that don't share your phone's biometrics.
- Biometrics. Worth a specific note: a fingerprint or face scan is not itself the second factor sent anywhere. It's the local unlock for a device-bound key, never leaves the device, and is only as phishing-resistant as the passkey system it's unlocking.
How they compare
Mapped against Microsoft Entra's own built-in authentication strength tiers, which classify methods into MFA, Passwordless MFA, and Phishing-resistant MFA:
| Method | Microsoft Entra tier | Phishing-resistant |
|---|---|---|
| SMS or voice call code | MFA strength only | Not phishing-resistantCodes can be intercepted, SIM-swapped, or simply read out by someone tricked into it. |
| Authenticator app, push notification or 6-digit code | MFA strength only | Not phishing-resistantVulnerable to real-time phishing relay and “MFA fatigue”, approving a flood of prompts by accident or exhaustion. |
| Authenticator app, phone sign-in (passwordless) | MFA + Passwordless MFA strength | PartialNo password needed, but the underlying approval step is still not bound to the specific site you're signing into. |
| Authenticator app, set up as a passkey | MFA + Passwordless + Phishing-resistant | Phishing-resistantSame app, different mode: a FIDO2 credential cryptographically bound to the real site, not a code that can be relayed. |
| Platform passkey (Windows Hello, Face ID, Touch ID) | MFA + Passwordless + Phishing-resistant | Phishing-resistantBiometric or PIN unlocks a device-bound key; the biometric never leaves the device and isn't the second factor by itself. |
| Hardware security key (e.g. YubiKey) | MFA + Passwordless + Phishing-resistant | Phishing-resistantThe same FIDO2 model as a passkey, on dedicated hardware, Microsoft's benchmark for phishing resistance. |
Source: Microsoft Entra authentication strengths and Microsoft's phishing-resistant MFA guidance, Microsoft Learn.
For Cyber Essentials specifically, any method in the table clears the MFA requirement, our MFA guide covers what the standard actually asks for. But if you're choosing what to roll out rather than just what's required, the "Not phishing-resistant" row is where most real-world account takeovers still happen. Passkeys and hardware keys cost more to deploy across a team; SMS and app codes cost nothing to switch on today. Neither is wrong as a starting point, but know which one you're actually getting.
Worth knowing
Not sure where your business currently stands? Run the free 5-minute readiness check or book a free 30-minute call.