Topic starter
10/07/2026 9:27 pm
TL;DR: A global real estate company moved from email and SMS one-time codes to broader MFA options, including passkeys and biometrics, across Azure AD B2C for employees in three regions, completing rollout in two months with no reported issues, according to Authsignal. The real lesson is that step-up authentication only works when policy, user experience, and regional governance are designed together, not bolted on after authentication gaps appear.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “How a global real estate company strengthened MFA with Authsignal”.
Key questions
Q: How should IAM teams reduce friction without weakening MFA controls?
A: Start by removing unnecessary steps, clarifying enrollment and recovery, and making the secure path the easiest path for each user population.
Q: Why do SMS and email OTPs create different risk profiles?
A: SMS and email OTPs depend on the security of the delivery channel, so the channel becomes part of the credential boundary.
Q: What are the signs that MFA policy needs to be redesigned?
A: Frequent user friction, inconsistent regional enforcement, reliance on a single OTP channel, and engineering bottlenecks for every policy change all point to a brittle MFA model.
Practitioner guidance
- Define MFA policy by risk and region Map which user groups need periodic step-up, country-based blocking, and exception handling before expanding factor choice across environments.
- Add phishing-resistant methods alongside existing flows Introduce passkeys and biometrics as supported options while keeping a controlled fallback path for users and recovery scenarios.
- Separate policy administration from engineering delivery Give trusted non-technical administrators authority to manage approved MFA rules while preserving change logs and review checkpoints.
Bottom line: Weak OTP-based MFA can meet a basic compliance need while still leaving organisations exposed to phishing and policy rigidity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:49 pm
Phishing-resistant MFA is now a governance problem, not just a factor choice. The important decision is not whether an organisation supports passkeys or biometrics in the abstract, but whether it can enforce context-aware policy across real user populations. In multi-region identity estates, the authentication method and the policy model have to evolve together. Practitioners should treat MFA modernisation as a governance design exercise, not a feature upgrade.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How do passkeys compare with passwords and SMS codes for identity assurance?
A: Passkeys remove the shared-secret problem that makes passwords and SMS codes easy to phish or intercept. They still require disciplined enrolment and recovery, but they shift assurance toward possession of a private key plus user verification, which is materially stronger than reusable credentials.
👉 Read our full editorial: Phishing-resistant MFA for Azure AD B2C in multi-region IAM