Topic 3 of 5
Authentication in Microsoft Entra ID
Authentication verifies a person's identity before granting access to a resource, app, device, or network. Entra ID offers many methods that balance security, usability, and deployment. The exam asks which method is phishing-resistant, which can be a primary factor, what comes free, and how SSPR and password protection work.
Contents
Authentication methods
Passwords are the most common method and the weakest when used alone: if they're easy to remember, they're easy to compromise; if they're strong, they get forgotten and hurt productivity. Microsoft recommends supplementing or replacing them, and the end goal is removing them (passwordless).
SMS
The user gets a code by text message. It can be a primary factor (SMS sign-in) or secondary in MFA and SSPR.
Voice call
An automated call to the registered number; the user presses # to complete. Secondary factor only, never primary.
OATH TOTP
Open standard for time-based one-time codes. Software (Authenticator or other apps; Entra generates the seed) or hardware (a fob with a code that changes every 30 or 60 seconds). Secondary only.
Temporary Access Pass (TAP)
A time-limited code issued by an admin to sign in and register other methods, including passwordless ones. Useful for onboarding users or recovering access.
QR code
Designed for frontline workers on shared devices: they scan a QR code (for example, on their badge) and enter a numeric PIN.
Email OTP
A code sent to email. Secondary factor in SSPR; it can also be configured for guest sign-in.
Authenticator Lite
Built into apps like Outlook mobile to complete MFA with push or codes without installing Microsoft Authenticator.
External authentication methods
Integrate a third-party MFA provider (for example, Duo or RSA SecurID) to satisfy MFA with a solution the organization already has.
Microsoft recommends moving away from SMS and voice for MFA in favor of modern methods like Microsoft Authenticator or passkeys.
Passwordless
Passwordless methods replace the password with something you have combined with something you are or something you know.
Windows Hello for Business
Combines a key or certificate tied to the device with a PIN or biometrics. The gesture uses a private key to sign data sent to the identity provider. An attacker needs both the device and the PIN or biometrics.
Passkeys (FIDO2)
Public key cryptography: a key pair is created at registration; the private key is stored securely and the public key is registered with Entra ID. Two types:
- Device-bound: the private key never leaves a physical device. Examples: FIDO2 keys (USB, Bluetooth, NFC) and passkeys in Microsoft Authenticator.
- Synced: the key syncs across the user's devices through a cloud provider, such as iCloud Keychain or Google Password Manager.
Microsoft Authenticator
A free app for iOS and Android with four modes: passkey (phishing-resistant), passwordless sign-in (the user matches a number and confirms with biometrics or PIN), push notification with number matching (as a second factor), and OATH codes.
Certificate-based authentication (CBA)
X.509 certificates directly against Entra ID, without federated infrastructure like AD FS. It works as a primary passwordless method and, when configured, as MFA.
Platform Credential for macOS
A credential backed by the Mac's Secure Enclave that provides passwordless sign-in and SSO across apps, unlocked with Touch ID or a password.
Phishing-resistant
With the rise of AI-driven cyberattacks, traditional MFA by SMS or email code is increasingly vulnerable to remote phishing. Phishing-resistant methods use public keys and the credential is bound to the origin domain where it was registered: the authenticator checks the domain before responding, so the credential won't work on a fake site and can't be replayed or shared.
The official list
Windows Hello for Business · Platform Credential for macOS · synced passkeys (FIDO2) · FIDO2 security keys · passkeys in Microsoft Authenticator · CBA
SMS, voice, email OTP, OATH, and Authenticator push are not phishing-resistant.
Primary and secondary factor
Some methods work for signing in (primary); others only as a second factor in MFA or SSPR:
| Method | Primary | Secondary |
|---|---|---|
| Windows Hello, passkeys, CBA, Platform Credential | Yes | MFA |
| Authenticator (passwordless) | Yes | No |
| Authenticator (push) | Yes | MFA and SSPR |
| Authenticator Lite | No | MFA |
| Hardware and software OATH | No | MFA and SSPR |
| External methods | No | MFA |
| SMS | Yes | MFA and SSPR |
| Voice call | No | MFA and SSPR |
| TAP | Yes | MFA |
| QR code | Yes | No |
| Email OTP | No | SSPR |
| Verified ID | No | Account recovery |
| Password | Yes | No |
Multifactor authentication
MFA prompts for another form of identification during sign-in. If you only use a password and it's weak or leaked, an attacker can get in; a second factor isn't easy to obtain or duplicate. It combines two or more of:
Something you know
Password or PIN
Something you have
A phone or hardware key that's hard to duplicate
Something you are
Fingerprint or face scan
Entra ID requests and processes MFA automatically, with no changes to apps. The user chooses from the methods they registered; an admin can require specific methods, and users can edit theirs in MyAccount.
Security defaults
A free baseline. For those who don't know where to start or use Entra ID Free.
Conditional Access
Granular control: MFA based on location, device state, risk, or app sensitivity. Requires P1 or P2.
Security defaults
Baseline mechanisms recommended by Microsoft that are enforced automatically once enabled, at no extra cost, and that come enabled by default on new tenants. According to Microsoft, MFA plus blocking legacy authentication stops more than 99.9% of common identity attacks.
- All users must register for MFA
- Administrators must perform MFA
- Users perform MFA when needed
- Legacy authentication protocols are blocked
- Privileged activities like access to the Azure portal are protected
When MFA is requested, Authenticator shows a number the user must type: number matching prevents MFA fatigue attacks, where the attacker sends prompts until the victim approves one.
Self-service password reset (SSPR)
It lets users change or reset their password without an admin or the help desk, for example if they're locked out or forgot it. It reduces calls and lost productivity, and its audit logs can be sent to a SIEM through an API.
The user opens the SSPR portal
Entra checks that the account is valid and that SSPR is enabled for it.
It checks the registered methods
The user must have registered the required methods.
It determines where the password is managed
In the cloud or in on-premises AD (with writeback).
It guides the reset
If everything passes, the user verifies their methods and chooses the new password.
User requirements
- A Microsoft Entra ID license
- SSPR enabled by an admin
- Registered methods (two or more recommended)
Supported methods
Authenticator push, software OATH, hardware OATH (preview), SMS, voice call, email OTP, and security questions (retiring in March 2027).
- The admin decides whether one or two methods are required. With a single method, Authenticator only supports the verification code.
- Administrators have SSPR enabled by default with two required methods and can't use security questions.
- You can require registration at next sign-in and ask users to reconfirm their methods periodically (0 to 730 days).
- Notifications: users get an email when their password is reset, and Global Administrators when another admin resets theirs.
- Password writeback (with P1): in hybrid environments, the change is written to on-premises AD whether using PHS, PTA, or federation. You can also let users unlock their on-premises account without resetting the password.
Account recovery
SSPR covers users who forgot their password but still have at least one method. If the user lost all their methods (for example, they lost their phone and have no backup), account recovery comes in, re-establishing trust through full identity verification.
| SSPR | Account recovery | |
|---|---|---|
| Case | Forgot the password, still has methods | Lost all methods |
| Requirement | At least one registered method | Verification through a certified provider (IDV) |
| Scope | Password only | Resets all methods |
Verification providers are in the Microsoft Security Store. Verified ID with Face Check compares a real-time selfie to the photo on the government ID and shares only the result, not the data. By removing human judgment, it avoids the social engineering typical of help desk recovery.
Password protection
Microsoft Entra Password Protection detects and blocks known weak passwords and their variants, plus weak terms specific to the organization, when users change or reset their password. It doesn't replace MFA: a strong password alone isn't as secure as multiple layers.
Global banned password list
Maintained by the ID Protection team from Entra telemetry and real password spray attacks, not external sources. Applied to all users automatically: nothing to configure and it can't be disabled.
Custom list
Your own terms: brands, products, locations like headquarters, internal terms, and acronyms. Maximum 1,000 terms, combined with the global list. Base terms work better than huge lists: variants are blocked automatically.
How a new password is evaluated:
Normalization
Lowercase and common substitutions (@ → a, $ → s, 1 → l, 0 → o).
Fuzzy matching
Edit distance of one: catches variants with one character changed, added, or removed.
Substring matching
Checks for the user's first and last name and the tenant name (terms of at least 4 characters).
Score
One point per banned term and one per remaining character. At least 5 points are required, so a long password can be accepted even if it contains a banned term.
Password spray
Instead of trying many passwords against one account, the attacker tries a few common passwords against many accounts, to avoid triggering lockout. The global list blocks exactly the passwords used in these attacks.
In hybrid environments it extends to AD DS with a proxy service (forwards policy downloads) and a DC agent on domain controllers, which checks hourly whether its policy is older than one hour. Domain controllers don't connect to the internet, no schema changes are needed, and it supplements (doesn't replace) AD DS password policies.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| A new hire must register a FIDO2 key on their first day | Temporary Access Pass | A temporary code issued by an admin to sign in and register methods. |
| Floor workers on shared tablets, without typing passwords | QR code authentication | They scan the QR on their badge and enter a PIN. |
| Require the strongest method against AI-powered phishing sites | Passkeys / FIDO2, WHfB, or CBA | They're bound to the origin domain. |
| A company with Entra ID Free wants MFA for everyone | Security defaults | Free; Conditional Access requires P1. |
| Users approve MFA notifications without looking (MFA fatigue) | Number matching in Authenticator | The user must type the number on the screen. |
| A user lost their phone and all their methods | Account recovery with Verified ID | SSPR requires at least one registered method. |
| Block passwords that include the company name | Custom banned password list | The organization's own terms, up to 1,000. |
| Reset the password and have it apply in on-premises AD | SSPR with writeback | Requires P1; works with PHS, PTA, or federation. |
Common exam traps
❓ Is a push notification with number matching phishing-resistant?
No. It helps against MFA fatigue, but the phishing-resistant methods are WHfB, passkeys, FIDO2 keys, Platform Credential, and CBA.
❓ Can a voice call be the primary sign-in method?
No. It's secondary only, for MFA and SSPR. SMS can be primary.
❓ An organization with Entra ID Free wants to require MFA for everyone. What does it use?
Security defaults. Conditional Access requires P1 or P2.
❓ Can the global banned password list be disabled?
No. It always applies to all users. The custom list is the one you configure.
❓ Can an administrator use security questions for SSPR?
No. Administrators use two required methods and can't use security questions.
❓ Does SSPR work if the user lost all their methods?
No. Account recovery with identity verification is needed.
❓ Who issues a Temporary Access Pass?
An administrator. It's a temporary code to sign in and register methods.
❓ Is a password containing a banned term always rejected?
No. If the total score reaches 5 points, it can be accepted.
Did you get this topic?
Test what you just learned
An employee forgot their password on a Sunday and wants to reset it without calling the help desk. Accounts are synced from on-premises AD. Which combination makes this possible?
Ready to test "Authentication, MFA, and SSPR"?
Original questions, each with a full explanation.
Start a mock exam