Multi-Factor & Phishing-Resistant Auth · Checklist Sicurezza Microsoft 365

Skillplan M365 Checklist

2026-07-20 19:25

Avanzamento valutazione 0 / 136 elementi 0%

Conformità finora 0 / 0 controlli 0%

Enable phishing-resistant authentication methods (FIDO2 keys, Windows Hello for Business, certificate-based auth) tenant-wide.

Enforce phishing-resistant MFA for all administrative roles via Conditional Access Authentication Strengths.

Disable SMS and voice-call MFA methods for any account holding an administrative role.

Enable Microsoft Authenticator number matching for all users to defeat MFA-fatigue attacks.

Enable additional context (app name, location) in Authenticator push notifications.

Run an authentication methods registration campaign to nudge users to Authenticator and away from SMS.

Audit and remove unused legacy MFA methods (security questions, voice OTP) from all user profiles.

Run an authentication-strength audit quarterly to confirm no admin role has a weak factor configured.