The order matters. Lock out the attacker without locking out your own staff.
1. Create two emergency access accounts. Microsoft recommends two cloud-only "break glass" Global Administrator accounts, excluded from your sign-in policies and protected with strong credentials kept offline. They are your way back in if a policy goes wrong. 2. Enable passkeys. In the Microsoft Entra admin center, go to Authentication methods and turn on Passkey (FIDO2). To allow passkeys in Microsoft Authenticator, add a passkey profile that permits device-bound passkeys and the Authenticator app. 3. Start with admins. Have every person with an admin role register a passkey or a security key. Then create a Conditional Access policy that requires the Phishing-resistant MFA authentication strength for admin roles. Run it in report-only mode for a few days before turning it on. 4. Move finance and executives next. The people who approve payments and wire transfers are the most targeted. Register passkeys for them, then add them to the policy. 5. Run a registration campaign for everyone else. Microsoft can prompt users to register a passkey or Authenticator at sign-in. Give people a deadline and a five-minute how-to. 6. Handle the exceptions. Shared front-desk computers, staff without a supported phone and contractors each need a plan, usually a FIDO2 security key or Windows Hello on a company computer. 7. Turn off the weakest methods. Once most people are on passkeys, remove text messages and voice calls as options where you can.
Plan for lost phones. A passkey on a phone is gone when the phone is. Decide in advance how someone proves who they are to get a temporary access pass, and make sure the help desk follows that process every time.