How FIDO2 Protects Microsoft 365 from Token Theft | Sourcepass MCOE

 

Why MFA Does Not Stop Token Theft

 

Not all MFA methods are created equal. SMS codes, one-time passwords, and push approvals all share the same weakness: they pass a secret through the browser that an attacker can capture and reuse. That is the line between standard MFA and phishing-resistant MFA.

The reason comes down to what happens after you prove who you are. Once you authenticate, Microsoft hands your browser a session token. That token is what the attacker is after.

It is a bearer credential. Whoever holds it is treated as you, no questions asked. Think of a hotel key card: you show ID at the front desk once, and after that the key opens the door without anyone re-checking who is holding it. Steal the token and you inherit the session. The password stays unknown. MFA is already satisfied.

For a deeper look at session theft, OAuth abuse, and other post-authentication attack techniques, see our article on how MFA is being bypassed in Microsoft 365. 

 

Which MFA Methods Qualify as Phishing-Resistant MFA?

 

 

Attack	SMS / Email Code	Authenticator Push or OTP	FIDO2 / Passkey	Windows Hello for Business
Phishing (fake login page)	Stolen	Stolen	Blocked	Blocked
SIM swap	Stolen	Not affected	Blocked	Blocked
MFA fatigue (push bombing)	Not applicable	User can approve	Blocked	Blocked
Adversary-in-the-middle proxy	Relayed	Relayed	Blocked	Blocked
Session token theft (post sign-in)	No protection	No protection	Limits exposure*	Limits exposure*

 

*Token theft happens after authentication succeeds, so it is contained through device binding and compliant-device policies rather than by the authenticator alone.

 

How Attackers Steal Microsoft 365 Session Tokens

 

The common method is adversary-in-the-middle (AiTM). The attacker stands up a reverse proxy and gets a user to click a link. The page looks and behaves like the real Microsoft sign-in, down to your company branding, and it carries a valid TLS certificate on a domain the attacker owns.

The user signs in and completes MFA against the real Microsoft servers through that proxy. On the way back, the proxy quietly copies the session cookie. Tooling like Evilginx and EvilProxy has turned this into a point-and-click attack sold as a service.

The tell, if you catch it, is the address bar. The domain will be wrong, and your password manager will not offer to fill credentials on a site it does not recognize. 

What makes this dangerous after the fact is how quiet it is. Every sign-in in the log looks successful and shows MFA satisfied. There are no bursts of failures and no push bombing. You are left correlating faint signals like a new IP appearing seconds after a legitimate one, which means watching the cloud session and the endpoint at the same time.

 

What is FIDO2 in Microsoft 365?

 

FIDO2 is a phishing-resistant authentication standard supported natively by Microsoft Entra ID. Instead of relying on passwords, text-message codes, or push notifications, FIDO2 uses public-key cryptography stored on a trusted device.

Microsoft Entra ID uses FIDO2 as the foundation for passkeys and passwordless authentication, and supports credentials stored on security keys, Windows Hello for Business devices, and mobile passkey providers. 

 

How FIDO2 Prevents Token Theft and Phishing 

 

The defense rests on one design choice: the private key never leaves your device, and only the matching public key is registered with Microsoft Entra ID. FIDO2 protects Microsoft 365 accounts in two important ways: 

 

Can Passkeys be Phished?

 

No, not in the way passwords and one-time codes can.

The difference is where the user sits in the process. With a push notification or rotating code, the user is the last line of defense, and a convincing enough page can persuade them to approve. A passkey removes that decision entirely. There is no code to hand over and no prompt to socially engineer, because the verification happens between the device and the legitimate service rather than through the person. 

 

FIDO2 Authentication Options in Microsoft 365

 

All three use the same FIDO2 standard. They differ only in how the credential is stored and what hardware it needs. 

 

 

One point that trips people up: Windows Hello for Business counts as multi-factor because it combines device possession with a local PIN or biometric. The PIN is not your password and never syncs to the cloud, which is exactly why it holds up. 

 

FIDO2 Works Best as Part of a Layered Security Strategy

 

• Compliant or managed device policies. Requiring a trusted device forces the browser to interact with the local system, which a headless proxy cannot do. Be aware that a few apps honor a token without re-checking it, so treat this as a layer, not a guarantee.
• Real incident response. A password reset is no longer enough. You need to revoke session and refresh tokens, review registered enterprise apps and OAuth grants, and remove any authentication methods the attacker added. A sophisticated actor will enroll their own MFA to hold the account.

 

How to Deploy FIDO2 Without Disrupting Users

 

1. Sort users into tiers. Privileged accounts get physical security keys. Managed-device users get Windows Hello for Business. Everyone else gets Authenticator passkeys. Passkey profiles in Entra let you set different rules for admins and frontline staff.
2. Register methods before you enforce. Turning on a phishing-resistant policy before admins have registered a passkey is the fastest way to lock yourself out. Keep a break-glass account excluded from the policy.
3. Pilot, then expand in waves. Start with security and admin cohorts, then finance, HR, and executives, then the rest. Validate browser and SSO behavior first, since some legacy and embedded mobile browsers fall back to push.
4. Do not forget public personas. Executives who speak on stage and anyone with authority in your industry are prime impersonation targets. They belong in the top tier.

 

Microsoft 365 FIDO2 Licensing Requirements

 

• In the Entra admin center, confirm your authentication methods are on the modern policy and that Passkeys (FIDO2) is enabled. Many tenants still carry legacy settings.
• Put one non-critical account behind a policy that requires phishing-resistant MFA, set a break-glass account aside, and live with it for a week. You will find where the QR handshake stalls before it reaches anyone who matters.

This timeline is now urgent. Microsoft-provided SMS and voice authentication will be retired for most users on February 1, 2027, just over three months away, and affected users who have no other method will face a blocking passkey-registration prompt. Email one-time passcodes are not part of this announced retirement, so organizations should focus this migration on SMS and voice users. 

Why FIDO2 is Becoming the New MFA Standard

 

AiTM attacks are a growing percentage of phishing attacks, and they continue to grow because the tooling is widely available and requires little technical expertise to operate.

FIDO2 and passkeys give Microsoft 365 organizations a path to phishing-resistant MFA. As token theft, adversary-in-the-middle attacks, and MFA bypass techniques continue to evolve, FIDO2 helps eliminate the credential theft risks that traditional authentication methods still leave behind.

Microsoft has already built the capability into Microsoft Entra ID. The challenge for most organizations is no longer access to the technology. It is deciding to make phishing-resistant authentication the new baseline. 

Not sure which users should get security keys, Windows Hello for Business, or mobile passkeys? The Sourcepass MCOE can help you assess your Microsoft 365 environment, identify high-risk accounts, and build a phishing-resistant MFA strategy that fits your business.