Phishing-Resistant MFA for Small Business: The Softix Inventory–Upgrade–Enforce Plan

Published: September 7, 2026 · Last updated: September 7, 2026 · Author: Softix
Category: Cybersecurity

Turning on multifactor authentication (MFA) was the right first move. For many US small and midsize businesses, that meant SMS codes, voice calls, or a tap-to-approve push on a phone. Those controls still beat passwords alone. They are not what CISA calls phishing-resistant MFA—and attackers already know how to walk around them.

This guide explains, in plain English, why SMS and push MFA remain bypassable, what phishing-resistant MFA actually is (FIDO2/WebAuthn, passkeys, hardware keys, and PKI where it fits), and how Softix’s Inventory–Upgrade–Enforce framework helps you migrate Microsoft 365, Google Workspace, and privileged admin accounts without pretending every legacy app supports FIDO tomorrow.

If you already want a deeper passkey enrollment and recovery playbook, pair this article with Softix’s passkeys rollout plan for small business. Identity is also only one layer: email spoofing defenses such as DMARC for small business and careful SaaS OAuth / delegated access hygiene reduce the blast radius when a login still fails.

Why “we have MFA” is no longer enough

CISA’s fact sheet Implementing Phishing-Resistant MFA (October 2022; still the agency’s core public hierarchy) is explicit: any MFA is better than none, but forms differ sharply in resistance to real attacks. Confirmed threat patterns CISA lists include:

• Phishing / adversary-in-the-middle (AiTM): A fake login page collects username, password, and the one-time code or prompt acceptance, then replays the session to the real service.
• Push bombing (MFA fatigue): Attackers who already have the password spam Approve prompts until someone taps yes out of annoyance or confusion.
• SS7 and SMS interception: Text or voice codes ride carrier networks that were not designed as enterprise authenticators.
• SIM swap: Social engineering against a mobile carrier moves the phone number—and the SMS codes—to an attacker-controlled SIM.

Confirmed fact (CISA): FIDO/WebAuthn authentication is described as the only widely available phishing-resistant authentication method for most organizations; PKI-based MFA (smart cards / enterprise certificates) is also phishing-resistant but harder for SMBs to run well. SMS or voice MFA is ranked as a last-resort temporary option.

Analysis (Softix): For most SMBs the practical risk is a targeted AiTM kit against a finance or admin mailbox—or a founder whose phone number is public. Customer and insurance questionnaires increasingly ask which MFA you use, not only whether MFA exists.

What counts as phishing-resistant MFA

Use precise language so your team does not relabel weak controls as strong ones.

Phishing-resistant (gold standard)

Per CISA and mainstream vendor documentation:

Microsoft Entra’s built-in Phishing-resistant MFA authentication strength allows combinations that include FIDO2 security keys, Windows Hello for Business (or platform credential), and multifactor certificate-based authentication (Microsoft Learn: authentication strengths).

Google Workspace documents that passkeys use phishing-resistant technology and can cover passwordless sign-in when admins allow users to skip password challenges (Google Workspace Admin Help).

Stronger than nothing, but not phishing-resistant

Confirmed fact (CISA): Number matching is not as strong as phishing-resistant MFA. CISA still recommends it as one of the best interim mitigations for organizations stuck on push MFA.

Softix framework: Inventory–Upgrade–Enforce

Softix’s framework is a phased operating model—not a product pitch and not a claim that every line-of-business app will support FIDO this quarter.

Phase 1 — Inventory

Before you buy a box of keys, write down what you already trust.

1. Identity providers: Microsoft 365 / Entra ID, Google Workspace, any separate IdP or SSO broker.
2. Authenticator methods in use: SMS, voice, push (with/without number matching), TOTP, passkeys, hardware keys, certificates.
3. High-value accounts: Global/super admins, billing, HR/payroll, finance, domain/DNS, break-glass accounts, shared mailboxes used as people.
4. Apps that gate on IdP MFA vs apps with their own login: Anything still on local passwords with SMS is a separate risk register entry.
5. Recovery paths: Backup codes, Temporary Access Pass (Entra), admin-generated Workspace recovery, secondary keys.

CISA asks which resources (email, remote access, identity) matter most and which users are high-value targets. Softix analysis: for most SMBs, email + IdP admins are the first work that removes most catastrophic takeover risk. Finish DMARC in parallel so spoofed mail does not undo strong login controls.

Phase 2 — Upgrade

Upgrade methods in order of risk reduction, not marketing slogans.

A. Turn on interim protections today

• If you rely on Microsoft Authenticator (or similar) push, enable number matching and train people to report unexpected prompts. CISA advises investigating denied push events—those can mean the password is already burned.
• Disable SMS/voice for anyone who can move to an authenticator app or a key, especially admins.
• Remove shared SMS MFA on a single founder phone for “the company account.”

B. Enroll phishing-resistant methods for critical users

• Issue two FIDO2 keys (primary + sealed backup) or enroll a hardware-backed passkey plus a second key for Global Admins / Workspace super admins.
• Prefer platform passkeys for knowledge workers once device management and recovery are defined—see Softix’s passkeys small-business rollout plan for Bind–Pilot–Recover–Expand detail.
• Use Microsoft’s guidance: register phishing-resistant methods before Conditional Access enforcement, and keep emergency access (“break-glass”) accounts excluded from lockout-prone policies (Require phishing-resistant MFA for Entra admin roles).

C. Handle legacy apps honestly

CISA notes some systems will not support phishing-resistant MFA yet. Practical Softix options:

• Put the app behind SSO (Entra ID or Google) so MFA happens at the IdP.
• Prefer vendors with FIDO/passkey support on the roadmap; escalate non-MFA systems to leadership as accepted risk.
• Keep TOTP or number-matched push as a documented interim for a named list of apps—with owners and review dates—not as a permanent “good enough.”

D. Align cloud baselines

CISA’s SCuBA / M365 & Entra guidance and ScubaGear assessments help measure tenant configuration drift. Softix analysis: private SMBs can still use the baselines as a practical checklist.

Phase 3 — Enforce

Enrollment without enforcement is theater.

Microsoft 365 / Entra (typical SMB path)

1. Enable authentication methods policy for FIDO2 / passkeys and Windows Hello where licensed.
2. Create Conditional Access in report-only first, then On.
3. Start with directory roles Microsoft lists as high priority (Global Administrator, Privileged Role Administrator, Exchange/SharePoint/User admins, and related roles in the admin phishing-resistant template).
4. Grant control: Require authentication strength → Phishing-resistant MFA.
5. Exclude break-glass accounts; document who can use them and how they are monitored.
6. Expand to finance/HR groups, then all users who can enroll; keep a documented exception list for legacy apps.

Note (Microsoft): Authentication strengths are evaluated after initial authentication; Entra ID P1 (or trial) is required for Conditional Access. External authentication methods have known compatibility limits with authentication strengths—verify Microsoft Learn before you cut over guest-heavy tenants.

Google Workspace

1. Enforce 2-Step Verification for the organization or by OU.
2. Restrict allowed methods: start by excluding SMS/phone codes; move admin OUs toward security keys / passkeys.
3. Allow passwordless passkeys where your edition and device strategy support it (skip passwords with passkeys).
4. Monitor enrollment with admin reporting / investigation tools before flipping “keys only” for everyone.

Enforce culture, not only policy

• Ban “approve to make it stop” as an acceptable behavior; run a short MFA-fatigue drill.
• Require a second registered method before the first vacation of a key holder.
• Tie SaaS admin consoles to SSO so you are not reinventing MFA per tool—related to Softix’s notes on SaaS OAuth identity risk.

Practical 30-day checklist

Week 1 — Inventory

• [ ] Export list of admins and privileged roles (Entra / Workspace).
• [ ] Screenshot current MFA methods per admin (SMS vs app vs key).
• [ ] List apps that do not federate to your IdP.
• [ ] Confirm break-glass account procedure exists on paper.

Week 2 — Upgrade (admins first)

• [ ] Enable number matching on push MFA if still in use.
• [ ] Enroll phishing-resistant methods for all Global/super admins (two factors each).
• [ ] Disable SMS for admin accounts where the platform allows.
• [ ] Pilot Conditional Access / 2SV restriction in report-only or on a test OU.

Week 3 — Expand

• [ ] Enroll finance, HR, and engineering leads.
• [ ] Put top three legacy apps on the SSO backlog or accepted-risk register.
• [ ] Train staff: unexpected MFA prompt = report, do not approve.

Week 4 — Enforce

• [ ] Move admin phishing-resistant policy from report-only to On.
• [ ] Schedule quarterly authenticator audit.
• [ ] Document exceptions with owners and expiry dates.
• [ ] Re-check email authentication (SPF/DKIM/DMARC) so phishing-resistant login is not undone by spoofed mail.

Limitations and honest trade-offs

• Hardware keys cost money and create logistics. Budget two keys for every privileged user; platform passkeys reduce shipping pain but need clear recovery rules.
• Licensing: Entra Conditional Access typically needs Microsoft Entra ID P1 (or bundles that include it). Confirm your SKU before promising enforcement dates.
• Not every SaaS supports FIDO yet. Inventory–Upgrade–Enforce assumes a living exception list, not perfection on day one.
• User friction is real. Softix analysis: resistance shrinks when admins go first and recovery is rehearsed—not when you surprise everyone on a Monday.
• No fabricated outcomes. This article claims no Softix customer breach stats or insurance discounts.

FAQ

Is SMS MFA better than nothing?

Yes. CISA still prefers any MFA over passwords alone. Treat SMS as a bridge while you enroll phishing-resistant methods—especially for admins.

Does number matching make us “phishing-resistant”?

No. It mitigates MFA fatigue; it does not stop a live AiTM phishing kit that steals a code or session. Use it as Phase 2 interim control while you move to FIDO2/passkeys.

Should every employee get a hardware key on day one?

Usually not. Softix analysis: prioritize privileged and high-value roles, prove recovery, then expand. Many knowledge workers can start with managed passkeys if your device posture supports it.

What if a legacy ERP cannot do FIDO?

Federate it behind SSO if possible; otherwise document TOTP/number-matched push as an interim control with an owner and review date, and escalate permanent gaps to leadership—exactly as CISA recommends for systems that cannot support modern MFA.

When Softix can help

If your gap is policy-only, your admin console and CISA’s fact sheets may be enough. If you need SSO integration, Conditional Access design, or custom app authentication, Softix’s custom software development and security engineering team can help wire Inventory–Upgrade–Enforce into the systems you actually run.

---