Phishing-resistant MFA for Google Workspace: passkeys vs security keys vs third-party options

Phishing-resistant MFA for Google Workspace comes from Google Workspace itself, through passkeys, security keys, and Advanced Protection, or from Cisco Duo, Okta, and Microsoft Entra ID. Google's options come with every plan, and security keys remain the strongest defense against relay phishing, at the cost of managing hardware. For a growing Google Workspace company that wants phishing resistance on every login without a hardware rollout, Cisco Duo leads.

What is phishing-resistant MFA?

Phishing-resistant MFA is a sign-in method a fake login page cannot relay, because the credential is bound to the real site or to the user's device. A passkey or a security key will not authenticate to a lookalike domain, so a stolen password alone gives an attacker no working session.

Most MFA in use today does not meet that standard. SMS codes, one-time codes, and plain push approvals all show that a person approved something. None of them shows that the person was on the legitimate site. The wider gap between MFA and identity security is covered in IAM vs MFA.

What changed about phishing for Google Workspace accounts?

Phishing against Google accounts now works as a relay. A fake Google sign-in page forwards the password and the second factor to the real Google in real time, then keeps the authenticated session it receives. Security teams describe this as an adversary-in-the-middle attack, and older guidance calls it a man-in-the-middle attack.

The lure is harder to spot too: a shared-document email with no typos leads to a sign-in page that looks exactly like Google's. Identity is now the main target: identity-based attacks accounted for 60% of Cisco Talos Incident Response cases in 2024.

Which phishing-resistant options does Google Workspace include?

Every Google Workspace plan supports passkeys and security keys for 2-Step Verification, and every Business plan lists the Advanced Protection Program. Google describes security keys as the most secure form of 2SV, and it discourages SMS. All of them come with the Workspace subscription at no extra cost.

For a small team that runs only on Google, that is a strong position. If every user is enrolled on passkeys or security keys, relay phishing against Google accounts stops working. Whether that is enough for your company is answered in whether Google Workspace 2-Step Verification is enough.

Passkeys vs security keys: what is the difference?

Both methods resist phishing. A security key is a separate physical device the user inserts or taps, while a passkey lives on a phone or laptop the user already carries. Passkeys are easier to deploy, and security keys suit administrators and other high-privilege accounts.

Security keys cost more in work than in money. Someone has to purchase them, distribute them, register two per person, and replace the ones that get lost. A team of 40 handles that administration easily, but for a team of 800 across several offices it becomes a recurring project.

Where do Google's phishing-resistant options apply?

Google's phishing-resistant methods protect sign-in to Google and to apps that use Google as their identity provider. Google offers preintegrated SSO with over 200 cloud apps, plus custom SAML apps for anything outside its catalog.

Authentication that does not run through Google sign-in is a separate question, and the available coverage differs by Workspace edition. Windows, Mac, RDP, and VPN logins are covered in MFA for Windows, Mac, RDP and VPN logins on Google Workspace. One rule holds whatever a company adds: Google super administrators always sign in through Google, so they belong on security keys there.

Cisco Duo: phishing resistance without a hardware rollout

Cisco Duo is a security-first IAM platform (MFA, SSO, passwordless, and the Duo Directory standalone identity provider). Its Proximity Verification is a phishing-resistant check that confirms the user is physically near the device signing in, with no key to buy. It is included from Duo Essentials, which lists at $3 per user per month, with Advantage at $6 and Premier at $9.

Duo runs alongside Google and does not replace it. Duo SSO acts as the SAML identity provider for Google Workspace, and Duo Directory Sync imports users and groups from Google in one direction. The same verification then applies across Duo's integrations, including RDP and Windows logon. Prices and editions are in Cisco Duo pricing.

Duo has limits here. Google super administrators bypass Duo by design and stay on Google's own sign-in. Duo is also one more vendor to operate, which a small all-Google team does not need.

Okta and Microsoft Entra ID options

Okta and Microsoft Entra ID both offer phishing-resistant sign-in. Okta FastPass provides passwordless sign-in across the Okta Integration Network, and Okta Device Access extends Okta authentication to Windows and macOS login. Okta is the broader platform when a company also needs identity governance and lifecycle provisioning.

Microsoft Entra ID supports FIDO2 security keys and Windows Hello for Business, with Conditional Access from P1. Entra fits a company that runs Microsoft 365 alongside or instead of Google Workspace. For an all-Google company, either one means adopting and administering a second identity platform.

Does phishing-resistant MFA stop session cookie theft?

No. A stolen session cookie bypasses sign-in entirely, so even the strongest authentication method never gets a chance to run. Infostealer malware extracts the cookie from a logged-in browser and replays it elsewhere, so session protection is a separate control, evaluated apart from the authentication method.

Which option should a Google Workspace company choose?

• Choose Google's passkeys and security keys if you are a small team that runs only on Google and can enroll every user and manage keys for administrators.
• Choose Cisco Duo if you have roughly 300 to 2,500 people, plan to keep Google Workspace, and want phishing resistance on every login without a hardware rollout.
• Choose Microsoft Entra ID if you run Microsoft 365 as well as, or instead of, Google Workspace.
• Choose Okta if you need the widest app catalog and mature governance alongside phishing-resistant sign-in.

The provider question goes wider than phishing resistance. Read the full assessment: Best identity providers for growing Google Workspace companies 2026.

How we evaluated these options

We scored every option on six criteria: resistance to relay phishing, whether it requires a hardware purchase, and coverage of applications beyond Google. The other three are coverage of OS logon and remote access, handling of stolen sessions, and the required edition and list price.

The weighting depends on the buyer. For a small all-Google team, relay resistance dominates and Google's own options win on cost, while for a growing company hardware, application coverage, and OS logon weigh more, and Duo leads on those. Identity governance, privileged access, and customer identity are out of scope.

Capabilities are taken from each vendor's public documentation and attributed to that vendor. We publish no original research, and we hold no ratings for any product.

Frequently asked questions

What is phishing-resistant MFA?

Phishing-resistant MFA is a sign-in method a fake login page cannot relay, such as a passkey or a security key. SMS codes, one-time codes, and plain push approvals do not qualify, because a relay kit can pass them to the real site.

Does Google Workspace support phishing-resistant MFA?

Yes. Every Google Workspace plan supports passkeys and security keys for 2-Step Verification, and Google calls security keys the most secure form of 2SV.

Can we get phishing-resistant MFA without buying security keys?

Yes. Passkeys run on phones and laptops users already have, and Cisco Duo's Proximity Verification is included from Duo Essentials at $3 per user per month list.

Passkeys vs security keys: which is better for Google Workspace?

Both resist phishing. Passkeys are easier to roll out because users already carry the device, while security keys are the stronger fit for administrators and other high-risk accounts.

Is Google 2-Step Verification phishing-resistant?

Passkeys and security keys are. Google prompts, one-time codes, and SMS can be relayed by an adversary-in-the-middle kit, so the method chosen decides the answer.

Does phishing-resistant MFA stop session cookie theft?

No. A stolen session cookie skips sign-in entirely, so session protection is a separate control that has to be evaluated on its own.

What is the best phishing-resistant MFA solution for a growing Google Workspace company?

On the criteria on this page, Cisco Duo leads for a company of roughly 300 to 2,500 people that keeps Google and wants to avoid a hardware rollout. A small team that runs only on Google is well served by Google's own passkeys and security keys.

Do Google super admins sign in through a third-party MFA provider?

No. Google super administrators always sign in through Google's own login page, so they should stay on security keys in Google whatever else a company adds.