# All user sign in activity uses phishing-resistant authentication methods
Phishing-resistant authentication methods like passkeys and FIDO2 security keys provide the strongest protection against credential theft and…
Source: https://maester.dev/docs/tests/ZTA.21784
:::note[Maester checks this too]
[CISA.MS.AAD.3.1](/docs/tests/CISA.MS.AAD.3.1) (Phishing-resistant MFA SHALL be enforced for all users.) checks the same setting. Running both reports it twice.
:::
## Overview
Phishing-resistant authentication methods like passkeys and FIDO2 security keys provide the strongest protection against credential theft and sophisticated phishing attacks. Traditional MFA methods remain vulnerable to adversary-in-the-middle attacks and social engineering. Enforcing phishing-resistant methods for all users through Conditional Access policies helps prevent unauthorized access even when attackers attempt to intercept authentication flows.
## Remediation
- [Configure Conditional Access for all users with MFA strength](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Deploy phishing-resistant passwordless authentication](https://learn.microsoft.com/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Conditional Access |
| Area | Authentication |
| ATT&CK | [T1566.002](/docs/tests?mitre=T1566.002) Spearphishing Link, [T1557](/docs/tests?mitre=T1557) Adversary-in-the-Middle, [T1111](/docs/tests?mitre=T1111) Multi-Factor Authentication Interception |
| Licence | P1 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.