Search2 Results

Action Required: Phishing Resistant Authentication Required for Admin Accounts
New requirement: All administrator accounts must use phishing-resistant authentication.
Deadline: October 27, 2026.
Required action: Register at least one phishing-resistant method per admin account (two if possible) and verify that it works.
Normal account: At least one phishing-resistant method is also required for the user's regular account.
Accepted methods: Passkeys (including Microsoft Authenticator and supported device-bound passkeys) and FIDO2 hardware security keys such as YubiKeys
Phishing-Resistant Methods - Setup and Use
The registration process to set up a YubiKey is the same for Windows, MacOS (using a Chrome browser) and mobile devices. However, MacOS requires that a PIN be set on the security key prior to registering the key with Microsoft.