MFA for Business: RSA Tokens vs Authenticator Apps vs Passkeys

Multi-Factor Authentication for Business: From RSA Tokens to Passkeys, and Which Method to Use

Codes from an app or a key fob stop password guessing, but modern phishing kits can steal the code and the session along with it. Here is how every MFA method compares, from SMS and RSA SecurID tokens to passkeys, why phishing-resistant MFA matters now, and how to roll it out without locking people out.

By the IT Support Hub team · Updated November 2026 · 4 min read

The short answer

Any MFA is far better than none. It stops the password guessing and reused-password attacks behind a large share of account takeovers.
Codes can be phished. Text messages, app codes and RSA-style key fob codes can all be relayed by a fake sign-in page that passes them to the real site in real time.
Passkeys and security keys cannot. They are tied to the real website’s address, so a look-alike page gets nothing usable. These are called phishing-resistant MFA.
Microsoft now requires MFA for its admin portals. Since February 9, 2026, the Microsoft 365 admin center blocks sign-in without it.

Feb 9, 2026Microsoft 365 admin center began blocking sign-ins without MFA

Oct 1, 2025Azure began enforcing MFA for command-line and automation tools

2023the year Microsoft Authenticator made number matching the default, curbing push fatigue attacks

What multi-factor authentication is

Multi-factor authentication, often called two-factor authentication or 2FA, means signing in with more than one kind of proof: something you know, such as a password; something you have, such as a phone or a hardware token; or something you are, such as a fingerprint or face. A stolen password alone is no longer enough.

Businesses first met MFA through hardware tokens such as RSA SecurID, the small key fobs showing a six-digit code that changes every minute. They are still used for VPNs and older systems. Today most people use an authenticator app on their phone, and a growing number use passkeys built into their laptop or phone.

Every method compared

Method	Stops password guessing	Resists real-time phishing	Convenience	Best for
Password only	No	No	High	Nothing that matters
Text message or voice call codes	Yes	No; also exposed to SIM swapping	High	A last-resort backup method
Hardware OTP token, such as RSA SecurID	Yes	No; codes can be relayed	Medium	VPNs and legacy systems, staff without phones
Authenticator app codes	Yes	No; codes can be relayed	Medium	Services without push or passkey support
Authenticator push with number matching	Yes	Partly; resists fatigue attacks, not proxy pages	High	Everyday Microsoft 365 sign-in
Passkeys on phone or laptop	Yes	Yes	High	Most staff, increasingly the default
FIDO2 security keys	Yes	Yes	Medium; a key to carry	Admins, finance, shared or no-phone users
Windows Hello for Business	Yes	Yes	High	Managed Windows PCs

Why codes are no longer enough

Modern phishing kits do not just collect passwords. They sit between the victim and the real Microsoft or Google sign-in page, passing everything through in real time. The victim types their password and code, the real site accepts them, and the kit keeps the session cookie that proves the user is signed in. The attacker then uses that cookie and never needs the code again.

A passkey is bound to the real website’s address. On a look-alike page it simply does not work, so there is nothing to relay.

Attackers also use MFA fatigue: sending push request after push request until a tired user taps Approve. Number matching, where the user types a number shown on the sign-in screen into the app, largely stops that. Microsoft Authenticator has used number matching by default since 2023.

Rolling out MFA without locking people out

Start with the accounts that matter most. Global admins, finance, payroll, the domain registrar, banking and remote access.
Give admins phishing-resistant methods. Security keys or passkeys for every administrator account, with no text message fallback.
Register every user before enforcing. A short registration campaign avoids a Monday morning of lockouts.
Turn off the weak methods. Remove text and voice as primary methods once people have something better.
Use conditional access. With Microsoft 365 Business Premium, require MFA by risk, location and device, and block legacy sign-in protocols that bypass MFA.
Plan for exceptions. Staff without company phones, shared warehouse devices and people who refuse personal phones for work can use security keys.
Keep two emergency admin accounts. Protected with security keys, stored securely and excluded from policies that could lock everyone out.
Teach one rule. Never approve a sign-in you did not start, and report it immediately.

Still using RSA tokens for the VPN?

Hardware tokens are not broken, but they are not phishing-resistant and they add a separate system to manage. Most firewalls and VPNs now accept Microsoft Entra ID sign-in, which brings your existing MFA, conditional access and passkeys to remote access and lets you retire the tokens when they come up for renewal.

Getting it done

We roll out MFA and passkeys for businesses across Toronto and the GTA through our Microsoft 365 support and cybersecurity services, including conditional access, security keys for admins and moving VPN sign-in to Microsoft Entra ID through our VPN support. For the email threats MFA protects against, see our guide to email security for business.

Questions people ask

What is the difference between 2FA and MFA?

Two-factor authentication uses exactly two kinds of proof, usually a password and a code. Multi-factor authentication means two or more. In everyday business use the terms are interchangeable.

Are RSA SecurID tokens still secure?

They still stop password guessing, but like any code-based method they can be relayed by a real-time phishing page. Many businesses now move VPN and system sign-in to Microsoft Entra ID with passkeys or security keys when tokens come up for renewal.

Is SMS two-factor authentication safe?

It is better than a password alone, but it is the weakest MFA method. Codes can be phished and phone numbers can be hijacked through SIM swapping. Use an authenticator app, passkey or security key instead where possible.

What is phishing-resistant MFA?

Phishing-resistant MFA, such as passkeys, FIDO2 security keys and Windows Hello for Business, is cryptographically tied to the real website. A fake sign-in page cannot use it, so there is no code for an attacker to capture or relay.

What are passkeys?

Passkeys replace passwords and codes with a cryptographic key stored on your phone, laptop or security key, unlocked with a fingerprint, face or PIN. They are phishing-resistant and are supported by Microsoft, Google and Apple.

Does Microsoft require MFA?

For administrators, yes. Microsoft enforces MFA for the Azure portal, Entra and Intune admin centers, and since February 9, 2026 the Microsoft 365 admin center blocks sign-in without MFA. Azure command-line and automation tools have required MFA since October 1, 2025, with postponements allowed until July 2026.

What if an employee does not want to use their personal phone?

Give them a FIDO2 security key. It works without a phone, is phishing-resistant and costs relatively little. Security keys also suit shared devices and staff in areas where phones are not allowed.

What is MFA fatigue?

MFA fatigue is when attackers who already have a password send repeated push approval requests, hoping the user eventually taps Approve. Number matching, where the user must enter a number shown on the sign-in screen, largely prevents it.