Phishing-resistant MFA for Admins

The question it answers: Which privileged roles in use are not required by Conditional Access to sign in with phishing-resistant MFA?

Push and SMS MFA can be phished with adversary-in-the-middle kits; passkeys, FIDO2 keys, Windows Hello and certificates cannot. Microsoft recommends requiring the built-in ‘Phishing-resistant MFA’ authentication strength for every privileged role. One row per privileged role that has members.

Note

A role counts as covered when an enforced policy targets the role (or all users), all cloud apps, and uses an authentication strength whose name contains ‘phishing’. Report-only policies do not count.

At a glance

Where in the app	Entra ID › Identity Hygiene › Phishing-resistant MFA for Admins
Workload	Entra ID
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Entra ID P1 (Conditional Access, authentication strengths).
Report id (API and MCP)	entra.security.admin-phishing-resistant-mfa

Columns

Column	Key	Type
Role	DisplayName	Text
Status	Category	Status
Members	Value	Text
Finding	Finding	Text
Held by	Detail	Text

Filters

Filter	Key (API)	On when the page opens
Only roles without enforcement	not-enforced	Yes

What it needs

Licence: Microsoft Entra ID P1 (Conditional Access, authentication strengths).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Policy.Read.All	Microsoft Graph	Read your organization’s policies
RoleManagement.Read.Directory	Microsoft Graph	Read all directory RBAC settings

Data sources it reads

• GET /v1.0/identity/conditionalAccess/policies
• GET /v1.0/roleManagement/directory/roleAssignments

Through the API and MCP

GET /ir-api/v1/reports/entra.security.admin-phishing-resistant-mfa?size=100
GET /ir-api/v1/reports/entra.security.admin-phishing-resistant-mfa?filter=not-enforced

An AI assistant reads it with the MCP tool get_report and the id entra.security.admin-phishing-resistant-mfa. The client needs the Read grant for Entra ID. See Using the API.