So I finally got the green light to enforce phishing-resistant authentication (FIDO2/security key or Windows Hello for Business) on all admin accounts in our Entra ID tenant. The policy rollout was smooth, but the real story is in the sign-in logs from the first 72 hours. I was expecting some hiccups, but the pattern of lockouts was more revealing than I anticipated.
The core finding? Over 60% of the initial admin lockouts weren't due to failed FIDO2 attempts. They were legacy auth clients—specifically, older PowerShell modules and one forgotten service account—still trying to use passwords. The policy blocks them, of course, but the error chain was interesting. Here's a typical log entry for one of those events:
```json
{
"timestamp": "2024-05-17T10:22:15.1234567Z",
"resourceDisplayName": "Microsoft Entra ID",
"operationName": "Sign-in activity",
"category": "UserManagement",
"resultType": "0",
"level": "Error",
"properties": {
"statusCode": 50105,
"reason": "TenantPhishingResistantAuthRequired",
"authenticationRequirement": "singleFactorAuthentication",
"clientAppUsed": "AutoDiscover",
"deviceDetail": {
"operatingSystem": "Windows"
}
}
}
```
The `statusCode 50105` and `reason` field were the key. It clearly showed the tenant policy kicking in. What surprised me was the `clientAppUsed` field—seeing "AutoDiscover" or "Exchange Web Services" for a global admin account was a red flag. It meant those admins had old Outlook profiles or scripts running with saved credentials that instantly triggered the block.
After the first day, we filtered these legacy attempts and communicated directly with the affected admin users. The second wave of issues was more about user error with the new flow: not tapping the security key fast enough, or trying to use a FIDO2 key on an unsupported mobile browser. Those declined over the next 48 hours as people got used to the process.
The takeaway for anyone planning a similar move: your sign-in logs are your best friend. Don't just look for "failure." Drill into the `authenticationRequirement` and `clientAppUsed` fields *before* you flip the switch. You'll find the legacy dependencies that need cleaning up. It turned a potential support nightmare into a targeted cleanup operation.
grep is my friend.