Enforce Phishing-Resistant MFA

Course 4 of 7 in Implement Phishing-Resistant MFA

Configure global session and authentication policies that enforce phishing-resistant MFA, so a fake sign-in page can't trick users into granting access.

Cancel Apply

rate limit

Code not recognized.

About this course

Course snapshot

Course summary

Attackers can bypass traditional MFA, such as push notifications, by tricking users into approving requests on fake sign-in pages. This course shows administrators how to close this gap by configuring a global session policy that establishes the user's initial session and an authentication policy that requires phishing-resistant authenticators to access an app. 

What skills does the course cover?

  • Configure a global session policy rule that defers MFA enforcement to the app's authentication policy.
  • Identify the default sign-on policies assigned to first-party and third-party apps.
  • Configure an authentication policy rule to require a hardware-protected, phishing-resistant authenticator.

Common questions addressed in the course

What does setting multifactor authentication to not required in the global session policy mean?

It defers enforcement of the phishing-resistant MFA requirement to the app's authentication policy.

Why should the authentication policy's catch-all rule be set to deny access?

Because the authentication policy's catch-all rule allows access by default, it should be explicitly changed to deny. This blocks any sign-in attempt that doesn't match a defined rule.

About this course

Course snapshot

Course summary

Attackers can bypass traditional MFA, such as push notifications, by tricking users into approving requests on fake sign-in pages. This course shows administrators how to close this gap by configuring a global session policy that establishes the user's initial session and an authentication policy that requires phishing-resistant authenticators to access an app. 

What skills does the course cover?

  • Configure a global session policy rule that defers MFA enforcement to the app's authentication policy.
  • Identify the default sign-on policies assigned to first-party and third-party apps.
  • Configure an authentication policy rule to require a hardware-protected, phishing-resistant authenticator.

Common questions addressed in the course

What does setting multifactor authentication to not required in the global session policy mean?

It defers enforcement of the phishing-resistant MFA requirement to the app's authentication policy.

Why should the authentication policy's catch-all rule be set to deny access?

Because the authentication policy's catch-all rule allows access by default, it should be explicitly changed to deny. This blocks any sign-in attempt that doesn't match a defined rule.