Phishing-resistant MFA: planning a FIDO2 and passkey rollout

Phishing-resistant authentication reduces reliance on shared secrets and one-time codes that attackers can intercept or trick users into entering. FIDO2 security keys and passkeys can provide a stronger sign-in experience when they are introduced with the right lifecycle process. Begin with privileged users and high-impact applications. Confirm browser, device, identity-provider, and recovery support. Decide how users enrol a primary factor, register a spare factor, replace lost devices, and prove their identity during recovery. These support paths are part of the security design. Run a pilot, collect usability feedback, and measure sign-in success. Train support teams to distinguish a lost factor from an account compromise. The aim is a strong default that users can successfully operate every day, with carefully controlled exceptions where they are genuinely needed.