What’s the best phishing-resistant, passwordless authentication strategy for a hybrid environment?

The longer-term architecture would be Entra-joined devices with Cloud Kerberos Trust, allowing those devices to authenticate to on-premises resources without maintaining the same endpoint dependency on traditional Active Directory joining. That may reduce complexity, but it is a larger change and should not be treated as a prerequisite for eliminating SMS.

Secret Double Octopus can be a viable passwordless option and may fit organizations that want a more centralized authentication experience. Whether it needs YubiKeys depends on the authentication methods and assurance level you select. Hardware keys are still a good independent fallback, especially for administrators and high-risk users.

If phishing resistance is the top priority and budget is available, use FIDO2 security keys, preferably two registered keys for every user who needs them. They are a strong fit for passwordless access and are much harder to compromise through phishing than SMS or approval prompts.

You can combine them with a broader passwordless platform, but the keys themselves are the important part. Plan enrollment, spare keys, replacement procedures, administrative accounts, and emergency access at the same time. Otherwise the security design may be good while the recovery process becomes painful.

Within your current constraints, Windows Hello for Business with Cloud Kerberos Trust is worth evaluating. It can provide passwordless sign-in while still allowing access to on-premises resources without the complexity of older certificate-based trust models.

As an immediate step, move the remaining SMS users to Microsoft Authenticator with number matching. Treat that as a transition rather than the final phishing-resistant solution. For stronger protection, issue hardware security keys and register at least two per user so a lost key does not become a helpdesk emergency.

Before removing Duo, make sure you have documented break-glass accounts, recovery procedures, and an offline or otherwise dependable sign-in path.

I would not remove Duo simply because SMS is being retired. Duo can continue providing MFA for Entra ID and may support passwordless workflows, depending on the exact integrations and licensing you have. If it is already deployed and working reliably, keeping it could be less disruptive than replacing the entire authentication layer.

The important question is what problem you are trying to solve by removing it: cost, product consolidation, user experience, or a security gap. Compare those requirements against Microsoft Authenticator, hardware security keys, and products such as Secret Double Octopus before deciding.