PA-05: Require Phishing-Resistant MFA for Admins

PA-05 is a security control that traditional mfa (push notifications, sms) can be bypassed through social engineering and mfa fatigue attacks. phishing-resistant methods like fido2 keys cannot be phished because they require physical presence and cryptographic proof. It requires that all users with privileged roles have registered phishing-resistant mfa and fido2 security keys, windows hello for business, or device-bound passkeys required, sms and voice call mfa methods are blocked for admin accounts.

Traditional MFA (push notifications, SMS) can be bypassed through social engineering and MFA fatigue attacks. Phishing-resistant methods like FIDO2 keys cannot be phished because they require physical presence and cryptographic proof.

Creates Conditional Access policy requiring FIDO2/Windows Hello for privileged roles

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

PA-05 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.

PA-05 is rated critical because failure to implement this control significantly increases the risk of security incidents. Traditional MFA (push notifications, SMS) can be bypassed through social engineering and MFA fatigue attacks. Phishing-resistant methods like FIDO2 keys cannot be phished because they require physical presence and cryptographic proof.