Tutorials · Security Operations
How to Roll Out Phishing-Resistant MFA With Passkeys and FIDO2 Security Keys
SMS codes and push approvals can be phished or spammed. Passkeys and FIDO2 security keys cannot. A rollout plan for admins first, then all staff.
Before you start
- An identity provider that supports FIDO2/passkeys (Microsoft Entra ID, Google Workspace, Okta and others)
- Two FIDO2 security keys per admin (one primary, one backup)
Step by step
Start with admins
Admins, finance and executives are targeted most. Enrol them first, with two keys each, kept in different places.
Enable the method in your identity provider
Turn on passkeys/FIDO2 as an authentication method and allow registration for a pilot group.
Register keys in person
Hand out keys at a short session: users register both keys and set a PIN. Record the key serials in your asset list.
Require it for admin portals
Use conditional access or sign-on policies so admin roles can only sign in with phishing-resistant methods.
Extend to all staff
Allow platform passkeys (Windows Hello, Touch ID, Android, iOS) for everyone, and phase out SMS and voice codes.
Plan for lost keys
Define a recovery process with identity checks by the helpdesk and a temporary access pass. Never fall back to SMS for admins.
Pro tips
- Network devices and NavCloud admin accounts also deserve MFA: enable it wherever available.
- Keep a few spare keys at the IT desk for fast replacement.
FAQ
Frequently asked questions
What is the difference between a passkey and a FIDO2 key?
Both use the same FIDO2 standard. A passkey lives on a phone or laptop and can sync; a security key is a separate hardware device, preferred for admins.
Keep learning
Related guides
Two-factor authentication for admin accounts
Read more →Start zero trust networking
Read more →SSH keys instead of passwords
Read more →How to Set Up a WireGuard VPN Server for Remote Access
WireGuard is a fast, modern VPN with a small, auditable code base. Build a WireGuard server on Linux, add users with their own keys and route them only to the networks they need.
Read more →How to Scan Your Network for Vulnerabilities With Nmap and OpenVAS
Find open ports, outdated services and known vulnerabilities before attackers do. Discover hosts with Nmap, then run authenticated vulnerability scans with Greenbone OpenVAS and fix what matters first.
Read more →How to Build a Free SIEM With Wazuh for Network and Server Logs
A SIEM collects logs from servers, firewalls and switches in one place and alerts on attacks. Install Wazuh, add agents and syslog sources, and tune the first alerts.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.