Authentication method capabilities

This page's changes and edits · All guidance changes

Microsoft's edit · 8 Mar 20:57 UTC

Copyedit authentication overview for Microsoft style guidelines

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 76b9ce6 · +9 −9 lines · also on GitHub

11 ---

2 −title: Microsoft Entra Authentication Overview

2 +title: Microsoft Entra authentication overview

33 description: Learn about the authentication methods and security features for user sign-ins with Microsoft Entra ID.

44 ms.topic: overview

5 −ms.date: 11/10/2025

5 +ms.date: 03/08/2026

66 ms.reviewer: sranjit

88 # Customer intent: As a Microsoft Entra administrator, I want to understand how Microsoft Entra ID makes it convenient to improve user sign-in security.

⋯ 4 unchanged lines

1313

1414 ## Authentication methods supported by Microsoft Entra ID

1515

16 −The following table outlines when an authentication method can be used for primary or first factor authentication, secondary factor authentication when you use Microsoft Entra multifactor authentication (MFA) and for self-service password reset (SSPR).  

16 +The following table outlines when an authentication method can be used for primary authentication (first factor), secondary authentication with Microsoft Entra multifactor authentication (MFA), and self-service password reset (SSPR).  

1717

1818

1919 | Method | Primary authentication | Secondary authentication |

⋯ 19 unchanged lines

3939

4040 1Windows Hello for Business can serve as a step-up MFA credential if a user is enabled for passkey (FIDO2) and has a passkey registered.

4141

42 −2Email OTP is available for tenant members for [Self-Service Password Recovery (SSPR)](concept-sspr-howitworks.md#authentication-methods). It may also be configured to be used for [sign-in by guest users](/entra/external-id/one-time-passcode).

42 +2Email OTP is available for tenant members for [self-service password reset (SSPR)](concept-sspr-howitworks.md#authentication-methods). You can also configure it for [sign-in by guest users](/entra/external-id/one-time-passcode).

4343

4444 ## Phishing-resistant authentication methods  

4545

46 −While traditional MFA with SMS, email OTP or authenticator apps significantly improves security over password-only systems, these options introduce friction—requiring additional steps for users, like entering codes, approving push notifications, or using authenticator apps. Moreover, these options for MFA are prone to remote phishing attacks. Remote phishing is where attackers use social engineering and AI-driven tools to steal identity credentials—like passwords or one-time codes—without physical access to a user's device. 

46 +While traditional MFA with SMS, email OTP, or authenticator apps significantly improves security over password-only systems, these options introduce friction—requiring additional steps for users, like entering codes, approving push notifications, or using authenticator apps. Moreover, these MFA options are prone to remote phishing attacks. In a remote phishing attack, attackers use social engineering and AI-driven tools to steal identity credentials—like passwords or one-time codes—without physical access to a user's device. 

4747

4848 Microsoft recommends using phishing-resistant authentication methods such as Windows Hello for Business, passkeys (FIDO2) and FIDO2 security keys, or certificate-based authentication (CBA) because they provide the most secure sign-in experience.

4949

⋯ 6 unchanged lines

5656 - Passkeys in Microsoft Authenticator

5757 - Certificate-based authentication (CBA) 

5858

59 −## High assurance account recovery

59 +## High-assurance account recovery

6060

61 −Account recovery is the process where users have lost all their credentials and can't access their account anymore. The traditional way to help users recover their credentials includes the user calling helpdesk, where they answer some questions to verify their identity, which allows helpdesk to reset their credentials. Microsoft Entra ID now supports government-issued ID and biometric verification, which offers AI-powered biometric match against government-issued IDs for high-assurance account recovery.

61 +Account recovery is the process of helping users who lost all their credentials and can no longer access their account. Traditionally, a user calls the help desk, answers questions to verify their identity, and the help desk resets their credentials. Microsoft Entra ID now supports government-issued ID verification with AI-powered biometric matching for high-assurance account recovery.

6262

63 −Organizations can choose amongst the leading identity verification providers (IDV) via [Microsoft Security Store](https://securitystore.microsoft.com/): Idemia, Lexis Nexis, and Au10tix. These partners offer coverage across 192 countries/regions and remote verification for most government-issued identity (Gov ID) documents, including driver's licenses and passports. Entra Verified ID Face Check, powered by Azure AI services, adds a critical layer of trust by matching a user’s real-time selfie and the photo from their identity document. By sharing only the match results and not any sensitive identity data, Face Check improves user privacy while allowing enterprises to be sure the person claiming an identity is really them.

63 +Organizations can choose from the leading identity verification providers (IDV) through the [Microsoft Security Store](https://securitystore.microsoft.com/): Idemia, Lexis Nexis, and Au10tix. These partners offer coverage across 192 countries/regions and remote verification for most government-issued ID documents, including driver's licenses and passports. Microsoft Entra Verified ID Face Check, powered by Azure AI services, adds a critical layer of trust by matching a user’s real-time selfie to the photo from their identity document. By sharing only the match results and not any sensitive identity data, Face Check improves user privacy while allowing enterprises to verify that the person claiming an identity is who they claim to be.

6464

65 −Once enabled, this capability enables a natively integrated end-to-end flow for users to easily and securely regain access to their accounts. For more information, see [Overview of Microsoft Entra ID Account Recovery](concept-account-recovery-overview.md).

65 +Once enabled, this capability provides a natively integrated end-to-end flow for users to securely regain access to their accounts. For more information, see [Overview of Microsoft Entra ID account recovery](concept-account-recovery-overview.md).

6666

6767 ## Related content

6868

⋯ 2 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.