Skip to content

Drones Era

Independent drone reviews, buying guides, and field-tested UAV intelligence for creators, operators, and serious buyers.

MFA for Drone Fleet Management Software: 2026 Field Guide

Drone fleet software MFA security 2026: FIDO2 passkey recommended, TOTP acceptable, SMS restricted per NIST 800-63B AAL2+

Multi-Factor Authentication for Drone Fleet Management Software: 2026 Field Guide

If your drone fleet management software uses SMS one-time codes or email magic links as its primary second factor, you are one SIM-swap away from a full fleet compromise. That is not a hypothetical. SIM-swap attacks on enterprise accounts have repeatedly led to multi-day operational outages for companies with much better security budgets than a 30-drone commercial operator. This is the field guide for drone fleet managers, Part 107 certificate holders running multi-aircraft operations, and security leads who inherited an AirData or DJI FlightHub 2 account and need to know what “secure enough” actually means under the NIST 800-63B standards that federal drone contractors are already being held to.

The federal pivot toward phishing-resistant multifactor authentication is no longer aspirational. OMB M-22-09 mandated phishing-resistant MFA for all federal agency users by 2024, and the trickle-down to federal drone contractors is well underway. If you fly for a federal prime, you will be asked to demonstrate compliance with NIST SP 800-63B Authenticator Assurance Level 2 or 3 inside the next 12 months. If you fly for a private operator, the same standards are a sensible ceiling to build toward regardless.

Why drone fleet accounts are a unique target

A drone fleet management platform is not just another SaaS login. The credential it protects controls four things a stolen password does not control in a normal SaaS world:

  • Live aircraft telemetry and live camera feeds from every active drone in the fleet, including coordinates.
  • Flight log history, which can include sensitive inspection imagery, infrastructure details, and customer-specific facility layouts.
  • Account-level billing and payment data, plus operator-level personally identifiable information (PII) for every PIC in the fleet.
  • Ability to push firmware updates and re-task aircraft, depending on platform.

A credential takeover on a fleet management platform is functionally equivalent to giving an adversary unauthenticated access to your operational perimeter for the duration of the session. The 2024 Internet Crime Report from the FBI’s Internet Crime Complaint Center documents credential theft as a leading vector in business email compromise and ransomware intrusions, with adjusted losses reported in the billions annually.

Most operators configure their accounts with the platform’s default authentication, which on consumer-leaning tools like AirData is an authenticator-app TOTP at best and SMS at worst. Enterprise-leaning tools like Skydio Cloud and DJI FlightHub 2 ship with SAML 2.0 SSO support, but the SSO is opt-in, not opt-out, and most small operators never turn it on. The result is a fleet of accounts that are individually as secure as a Gmail account from 2014.

What NIST SP 800-63B actually requires

The NIST Digital Identity Guidelines define three Authenticator Assurance Levels. AAL1 is single-factor authentication (a password alone), AAL2 is multi-factor authentication using two of the three factor types (something you know, something you have, something you are), and AAL3 is hardware-cryptographic multi-factor plus verifier impersonation resistance. The relevant level for drone fleet operators is AAL2, with AAL3 reserved for high-value accounts like the master tenant administrator.

The 2024-2026 revision of 800-63B did something specific that fleet managers need to know about: it explicitly downgraded SMS, voice, and email-OTP authenticators to “restricted” status for new applications. Restricted means the authenticator can still be used, but only with documented compensating controls and a clear business case for why phishing-resistant options are unavailable. The reason is the well-documented vulnerability of SMS-OTP to SIM-swap attacks and the vulnerability of email-OTP to mailbox compromise. CISA’s More Than a Password page makes the position explicit: phishing-resistant MFA is the only MFA CISA recommends, period.

Phishing-resistant MFA, per CISA’s definition, means an authenticator that cryptographically binds the credential to the origin site (typically FIDO2/WebAuthn passkeys or PKI smart cards), resists adversary-in-the-middle proxy attacks by design, and uses hardware-rooted key material. SMS does not qualify. Voice calls do not qualify. Authenticator-app TOTP codes (Google Authenticator, Authy, Microsoft Authenticator) are multi-factor but are explicitly NOT phishing-resistant — an attacker who AitM-phishes your credentials in real time also captures your TOTP code.

Which MFA methods actually work for drone fleet operations

For the actual fleet management platforms in use today, the MFA landscape looks like this.

FIDO2 / WebAuthn passkeys (best option)

Passkeys are the right answer for almost every drone fleet account. They are phishing-resistant by construction because the cryptographic key is bound to the specific origin URL — a passkey enrolled on `login.skydio.com` will not sign an authentication challenge from `skydio-login.attacker.com`. Passkeys also work offline, which matters for operators flying in remote sites where the cellular signal is intermittent. Both Skydio Cloud and DJI FlightHub 2 support FIDO2 passkeys on their enterprise tiers as of 2026; AirData supports passkeys for individual accounts at the time of writing.

The deployment trade-off is hardware. Passkeys require either a platform authenticator (Apple iCloud Keychain, Windows Hello, Android’s credential store) or a roaming hardware authenticator (YubiKey, Feitian K9, Token2). For a fleet manager distributing passkeys across a 10-PIC operation, the cheapest viable path is a YubiKey 5 NFC per PIC at roughly $50 each, plus a pair of spares per PIC for redundancy. Total rollout cost lands around $700 for a 10-PIC operation, which is roughly what you would spend on a single day of lost operations if a fleet account were compromised.

TOTP authenticator apps (acceptable middle ground)

Authenticator-app TOTP is multi-factor and reasonably resistant to bulk credential-stuffing attacks, but it is NOT phishing-resistant. If a PIC types their password and TOTP code into a phishing page that AitM-relays both to the real site in real time, both factors are captured and replayed. TOTP is the right choice for PIC accounts that do not hold fleet-wide admin privileges. It is the wrong choice for the master admin and for any account that can push firmware or export flight logs.

The deployment trade-off is convenience. TOTP is free, works on any smartphone, and is supported by every fleet management platform that supports any MFA at all. The implementation rule: enforce TOTP for all PIC accounts that touch the fleet, and require a phishing-resistant second factor for the master admin.

SMS / voice / email OTP (do not deploy new, plan migration)

If you are reading this and your current fleet management platform uses SMS or email-OTP as the only available MFA option, that platform is below the federal contractor floor and you need a migration plan. Email-OTP in particular fails the “two different factors” test under 800-63B: both the password and the OTP code are “something you know” factors (the email account password and the inbox contents), which means an email-OTP-only configuration is not actually multi-factor in the strict sense.

The migration path is twofold. First, audit which platform-issued accounts exist, who holds them, and what privileges they have. Second, for each account, check whether the platform supports SAML/OIDC SSO to your identity provider. If it does, federate the account to Okta, Microsoft Entra ID, Google Workspace, or JumpCloud, and let your IdP enforce phishing-resistant MFA on the IdP side. This is what the OMB M-22-09 federal mandate effectively requires for federal contractor systems.

SSO / SAML 2.0 / OIDC federation (the enterprise ceiling)

SAML 2.0 SSO is supported by Skydio Cloud, DJI FlightHub 2 Enterprise, and the major US-based fleet management platforms. OIDC federation is increasingly supported as well. Federating your fleet accounts to a corporate IdP gives you four operational wins at once: phishing-resistant MFA is enforced centrally, offboarding a departing PIC is a one-click operation instead of a per-platform password reset, audit trails are consolidated, and password reuse risk is eliminated because PICs do not have separate platform-specific passwords to leak.

The deployment trade-off is operational complexity. SSO federation requires a corporate IdP, which is a meaningful cost line item if you are a 5-PIC operation. The honest answer for a small operator: if you cannot afford an enterprise IdP, skip SAML federation and use FIDO2 passkeys directly on each platform account. If you have 5+ PICs and any federal contract exposure, an IdP pays for itself inside the first credential-takeover incident it prevents.

Vendor-by-vendor current state

Skydio Cloud’s published security overview documents SOC 2 Type II and ISO 27001 certifications, with SAML 2.0 SSO supported and phishing-resistant MFA available at the identity-provider level once federated. The platform is the closest to “secure by default” of the three US-based enterprise fleet management tools.

DJI FlightHub 2 supports role-based access control and SSO/SAML on enterprise licenses. The vendor’s public security page does not enumerate specific MFA options, which is itself a finding — operators should ask DJI directly which authenticator types are supported at each license tier.

AirData UAV is consumer-leaning and supports TOTP via authenticator app on individual accounts. SSO is available on the enterprise tier but is not the default path for the bulk of users. If you are running AirData for a commercial operation and have not turned on SSO, you are running below the floor for federal contractor operations.

DroneDeploy’s public security page is currently thin and the vendor has been quiet on the specific MFA options offered on each tier. Operators using DroneDeploy should treat the platform as TOTP-or-better and confirm with the vendor directly whether FIDO2 passkey support is available.

What “secure enough” looks like in practice

The honest floor for a commercial drone operation in 2026 is this:

  • Master admin account: FIDO2 passkey (hardware-backed, ideally YubiKey 5 or equivalent) + a strong passphrase enrolled as the second factor.
  • All PIC accounts: at minimum TOTP via authenticator app; FIDO2 passkey preferred.
  • No SMS, voice, or email-OTP as the only MFA option anywhere in the fleet account hierarchy.
  • SSO federation to a corporate IdP if you have 5+ PICs or any federal contract exposure.
  • Quarterly credential-breach check via Have I Been Pwned on every admin email address, with password rotation triggered on any positive hit.
  • Documented offboarding procedure that revokes platform-issued credentials within 24 hours of a PIC’s departure.

This is not the cheapest configuration to deploy. It is also not optional if you want to fly for federal primes under the current procurement landscape, and it is the only configuration that holds up if a single PIC’s credentials end up in a SIM-swap database.

FAQ

Does the FAA require MFA on Part 107 fleet management credentials?

No. The FAA does not currently mandate MFA on Part 107 operator credentials under 14 CFR Part 107. However, if you contract with a federal agency or federal prime contractor, the procurement clauses typically require NIST 800-63B AAL2 or higher for any system that touches federal data, which includes fleet management platforms with telemetry logs from federal-site operations. The practical answer is: FAA does not require it, but your federal customers do.

Is SMS-based MFA acceptable for small commercial drone operators?

Under NIST 800-63B’s 2024-2026 revision, SMS is “restricted” — usable only with documented compensating controls. CISA explicitly does not recommend SMS-OTP for any account with administrative privileges. For a small commercial operation running 3-5 drones, SMS is technically still allowed but is the lowest-trust option. If you can deploy TOTP or passkeys instead, do so. SMS is acceptable as a fallback path for PIC accounts that have been locked out of their authenticator app, not as the primary MFA method.

What happens if my fleet management account is compromised?

The immediate response is to log out all active sessions on the platform, rotate the master admin password, revoke all API tokens, audit the last 30 days of flight logs for unauthorized access, and notify any customers whose facility details may have been exposed through flight imagery. If the account held telemetry from federal sites, you have a CISA-reportable incident under CIRCIA reporting timelines once the final rule takes effect. Document the incident in writing before you do anything else, because the timeline matters for insurance claims.

Can I use the same passkey across multiple drone fleet platforms?

Passkeys are bound to a specific origin URL by design, so a passkey enrolled on `login.skydio.com` will not authenticate against `flighthub2.dji.com`. If you operate across Skydio and DJI, you need separate passkeys for each platform’s login origin. Hardware authenticators like YubiKey 5 can store multiple passkeys simultaneously — the same YubiKey can hold your Skydio passkey, your DJI passkey, your AirData passkey, and your Google Workspace passkey without any cross-origin leakage.

What is the cheapest way to roll out hardware-backed MFA to a 5-PIC operation?

YubiKey 5 NFC at roughly $50 per key, with two keys per PIC for redundancy (one daily-use key, one locked safe backup), lands at $500 total for 5 PICs. Add a TOTP authenticator app on each PIC’s phone as a fallback for lost keys, and you have a deployment that meets CISA’s phishing-resistant MFA recommendation at the lowest viable cost.

Conclusion

Multi-factor authentication for drone fleet management software is one of those rare security topics where the technical standard, the regulatory standard, and the practical operational standard all converge on the same answer: phishing-resistant MFA, hardware-backed where possible, federated through SSO where the operation is large enough to justify an IdP. The platforms in use today support this configuration. The migration from SMS-OTP and email-OTP to passkeys is the only thing standing between a typical drone fleet account and a SIM-swap or credential-stuffing compromise. The federal contractor floor is the right floor to build on regardless of whether you currently fly for federal primes, because it is the only configuration that has been publicly validated against the threat model that actual attackers use against enterprise credentials.

Get the passkeys. Get the IdP if you are big enough. Get the YubiKeys. Skip the SMS path. That is the 2026 field guide.