2 min lesson
IdP administration: Okta and Entra
Connect "Most integrations come from the IdP's app catalog, called the OIN in Okta and the gallery in Entra" to the decision you would make.
Step 1 of 4
The IdP is the most security-critical system you'll run. Own it and you own access to everything. Interviewers want to hear that you treat it with the operational discipline that blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. deserves.
Learn more
Full explanation
MFA and passwordless
MFA and passwordlessphishing-resistant by default
Not all factors are equal. SMS and TOTP are phishable; FIDO2/passkeys are phishing-resistant because the credential is bound to the origin and never leaves the device. For a security-forward company, the target is phishing-resistant MFA as the baseline, with weaker factors phased out.
- Factor
- SMS / voice
- Phishing-resistant?
- No. SIM-swap and relay attacks beat it.
- Use as
- Last resort, deprecate where possible
- Factor
- TOTP authenticator
- Phishing-resistant?
- No. Codes can be relayed.
- Use as
- Acceptable fallback, not the goal
- Factor
- Push with number-match
- Phishing-resistant?
- Better. Number matching defeats push fatigue.
- Use as
- Reasonable interim
- Factor
- FIDO2 / passkey
- Phishing-resistant?
- Yes. The credential is bound to the origin.
- Use as
- Baseline target for the workforce
| Factor | Phishing-resistant? | Use as |
|---|---|---|
| SMS / voice | No. SIM-swap and relay attacks beat it. | Last resort, deprecate where possible |
| TOTP authenticator | No. Codes can be relayed. | Acceptable fallback, not the goal |
| Push with number-match | Better. Number matching defeats push fatigue. | Reasonable interim |
| FIDO2 / passkey | Yes. The credential is bound to the origin. | Baseline target for the workforce |
Drive the fleet toward passkeys; keep one phishable fallback only for recovery edge cases.
Learn more
Optional practice
Test yourself on IdP administration: Okta and Entra
QWhy are FIDO2/passkeys considered phishing-resistant when TOTP and SMS are not?