Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Protect Entra ID sign-ins in layers: require phishing-resistant authentication, apply risk-based and step-up controls, limit replay of supported session tokens with Token Protection, and monitor a staged rollout. These controls address different parts of an attack. Passkeys and other phishing-resistant methods make credential theft harder; device-bound token controls help limit the reuse of a stolen session. Neither replaces endpoint security, monitoring, or recovery planning.
How do I stop phishing attacks on Microsoft Entra ID?
Start by reducing the value of a password stolen through a fake sign-in page. Microsoft classifies Windows Hello for Business, passkeys using FIDO2, FIDO2 security keys, and certificate-based authentication as phishing-resistant. Its documented options also include platform credentials for macOS and passkeys in Microsoft Authenticator. Traditional MFA methods such as SMS and one-time codes can still be vulnerable to remote phishing, so enabling MFA alone is not the same as requiring phishing-resistant MFA.
As an Amazon Associate I earn from qualifying purchases.
Choose methods based on the user’s devices, enrollment and recovery needs, and whether the credential is synced or bound to one device. A synced passkey stored in a credential manager has different operational properties from a device-bound passkey, such as one stored on a security key. A physical FIDO2 key can be an option for users who need a separate authenticator; confirm its connector and platform compatibility and that the tenant’s policy accepts the method before purchasing or deploying it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use stronger authentication for privileged roles first
Prioritize phishing-resistant MFA for privileged administrator accounts, then expand to other users as enrollment and support processes are ready. Microsoft recommends it for at least these roles:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Global Administrator, Application Administrator, Authentication Administrator, Billing Administrator, and Cloud Application Administrator
- Conditional Access Administrator, Exchange Administrator, SharePoint Administrator, and Security Administrator
- Helpdesk Administrator, Password Administrator, User Administrator, and Privileged Authentication Administrator
- Privileged Role Administrator
Have administrators register an accepted method before enforcing the requirement. Keep emergency access accounts outside the policy and maintain a tested way to use them. User-scoped Conditional Access policies do not cover service principals; protect workload identities with workload-identity controls, and consider replacing script-held credentials with managed identities.
How do I prevent session token theft?
A successful MFA challenge protects the initial sign-in, but it does not necessarily stop an attacker from stealing and replaying a session token afterward. Token Protection is a Conditional Access session control that attempts to reduce this replay risk by binding supported refresh tokens cryptographically to the device. In a supported scenario, a stolen bound token cannot be used from another device.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check whether your apps and devices are supported
Token Protection is not universal coverage. Microsoft lists native application support as generally available on Windows, iOS/iPadOS, and macOS. Browser-based support is more limited and is described as preview for selected web apps and configurations accessing Azure Resource Manager. Confirm the current supported-app, platform, and configuration lists before relying on it for a workload.
The control depends on a suitable registered-device and Primary Refresh Token (PRT) scenario. Unregistered devices lack PRTs, and a different identity used on a device may not have the valid PRT required for protection. Microsoft’s deployment guidance identifies unsupported Windows registration cases including some Azure Virtual Desktop session hosts, Windows 365 Cloud PCs joined to Entra, bulk-enrolled devices, self-deploying Autopilot devices, hosted Power Automate machine groups, and some Azure virtual machines using the Entra authentication extension. Treat that list as a prompt to check the current deployment guidance, not as a permanent or exhaustive inventory.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Pair token binding with other session controls
For apps that do not support Token Protection, network-based enforcement can provide a complementary restriction on where sessions are usable. Compliant-network policies or location restrictions can limit replay outside designated networks. This approach may require network changes; traditional VPN routing can bring performance and cost trade-offs. Continuous Access Evaluation-aware apps, including SharePoint Online and Exchange Online, can evaluate some network-based restrictions for app sessions.
Microsoft also recommends device hardening, risk-based Conditional Access, monitoring, and interactive reauthentication for sensitive actions. Treat risk detections as signals rather than a guarantee that every stolen token will be detected. Define how administrators will investigate suspicious activity and remediate affected accounts.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Does MFA stop token theft?
No. MFA can make it harder to use a stolen password to complete an initial sign-in, but MFA by itself does not guarantee that a session token cannot be stolen or replayed. Phishing-resistant authentication and session-token protections address related but distinct stages:
| Control | Primary purpose | Important limit |
|---|---|---|
| Phishing-resistant authentication | Makes it harder for a fake sign-in page or remote attacker to capture and reuse the user’s authentication. | It does not, on its own, prevent replay of a stolen session token. |
| Token Protection | Reduces replay of supported, device-bound refresh tokens from another device. | Coverage depends on supported apps, platforms, device registration, and the user’s PRT scenario. |
| Risk-based and network-based controls | Add conditions and signals that can restrict access or prompt for stronger authentication. | They depend on policy scope and supported app behavior; risk detections are not comprehensive detection guarantees. |
What is Entra Token Protection?
Entra Token Protection is a Conditional Access session control designed to reduce the risk that a supported refresh token stolen from one device can be replayed elsewhere. It uses cryptographic device binding, rather than simply checking that the user passed MFA earlier. Microsoft describes it as one component of a broader defense-in-depth strategy against token theft.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
It should not be treated as a substitute for endpoint security, risk controls, monitoring, or appropriate network restrictions. Before deploying it, check the current Microsoft documentation for supported applications and device configurations; availability and coverage can change.
How do I require phishing-resistant MFA for Entra admins?
- Inventory privileged users and workloads. Identify administrators in the roles listed above, service principals, and emergency access accounts. Plan protections for workload identities separately from user-scoped policies.
- Enroll administrators first. Ensure each administrator has registered an accepted phishing-resistant method and that the organization can support enrollment and recovery. Do not enforce the requirement before users can satisfy it.
- Scope the user policy carefully. Apply the phishing-resistant authentication requirement to privileged users, while excluding emergency access accounts from that policy. Review policy scope and exclusions so they match the tenant’s recovery plan.
- Test before broad enforcement. Use report-only evaluation where available, examine sign-in results for expected and unexpected effects, and resolve enrollment or compatibility problems before turning on enforcement.
- Protect service principals separately. Use workload-identity controls rather than assuming the user policy covers them; where appropriate, replace credentials stored in scripts with managed identities.
How should I roll out Token Protection?
- Choose a small, representative pilot. Include the applications, devices, and registration patterns that matter to the deployment, and check the documented unsupported scenarios before assigning the policy.
- Create the Conditional Access policy in report-only mode. Evaluate the intended scope without immediately blocking sign-ins.
- Review interactive and non-interactive sign-in logs. Use the available fields to investigate policy results and identify unsupported device-registration types. Microsoft’s deployment guide describes using device filters for exclusions in relevant cases.
- Observe normal application use before enforcement. Allow the pilot to cover ordinary workflows, investigate compatibility problems, and make policy changes based on observed results.
- Expand gradually. Add users and workloads in stages after the pilot shows that the required apps and device scenarios work as expected.
What should users know about Microsoft passkeys and SMS or voice changes?
Microsoft’s published timeline says passkeys became the default authentication experience starting September 1, 2026. It says users enabled for SMS or voice are automatically enabled for passkeys and prompted to register after an MFA sign-in. Because that date has passed, administrators should check the current Microsoft timeline and tenant scope rather than assume every tenant or user has identical settings.
The same timeline schedules retirement of Microsoft-provided SMS and voice for most users on February 1, 2027, and for Global Administrators and external users on July 1, 2027. Internal guest users remain in the February cohort. Users who rely only on those methods may face a blocking passkey-registration prompt after the applicable retirement date. Customers that need continued telephony are directed to configure a provider through Microsoft Security Store. Verify the live schedule and affected users before using these dates as a migration deadline.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
