Authentication method capabilities
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c29e003 · +58 −42 lines · also on GitHub
11
---
22
title: Microsoft Entra authentication overview
3
−description: Learn about the authentication methods and security features for user sign-ins with Microsoft Entra ID.
4
−ms.topic: overview
5
−ms.date: 03/08/2026
6
−ms.reviewer: sranjit
3
+description: Authentication is the process of verifying identity before granting access. Learn about the authentication methods available in Microsoft Entra ID.
4
+author: tilarso
5
+ms.author: tilarso
6
+ms.service: entra-id
7
+ms.topic: concept-article
8
+ms.custom: msecd-doc-authoring-108
9
+ms.date: 04/30/2026
710
8
−# Customer intent: As a Microsoft Entra administrator, I want to understand how Microsoft Entra ID makes it convenient to improve user sign-in security.
11
+#customer intent: As an identity administrator, I want to understand the authentication methods available in Microsoft Entra ID so that I can choose the right methods for my organization's security and user experience requirements.
12
+
913
---
10
−# What is Microsoft Entra authentication?
1114
12
−Authentication is the process of verifying a person's identity before granting access to a resource, application, service, device, or network. It's how a system makes sure **users are who they say they are** when they try to sign in.
15
+# Microsoft Entra authentication overview
1316
14
−## Authentication methods supported by Microsoft Entra ID
17
+Authentication is a security process that verifies a user's identity before granting access to apps, services, devices, or networks.
1518
16
−The following table outlines when an authentication method can be used for primary authentication (first factor), secondary authentication with Microsoft Entra multifactor authentication (MFA), and self-service password reset (SSPR).
19
+## Authentication methods supported by Microsoft Entra ID
1720
21
+The following table outlines when an authentication method can be used for primary authentication (first factor), secondary authentication with Microsoft Entra multifactor authentication (MFA), self-service password reset (SSPR), or account recovery.
1822
19
−| Method | Primary authentication | Secondary authentication |
20
−|--------------------------------|:----------------------:|:-------------------------:|
21
−| [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-overview) | Yes | MFA<sup>1</sup> |
22
−| [Platform Credential for macOS](/entra/identity/authentication/concept-authentication-platform-credential-for-macos) | Yes | MFA |
23
−| [Passkey (FIDO2)](concept-authentication-passkeys-fido2.md) | Yes | MFA |
24
−| [Passkey in Microsoft Authenticator](concept-authentication-authenticator-app.md)| Yes | MFA |
25
−| [Synced passkey](concept-authentication-passkeys-fido2.md)| Yes | MFA |
26
−| [Certificate-based authentication](concept-certificate-based-authentication.md)| Yes | MFA |
27
−| [Microsoft Authenticator passwordless](concept-authentication-authenticator-app.md#passwordless-sign-in-via-notifications)| Yes | No |
28
−| [Microsoft Authenticator push notifications](concept-authentication-authenticator-app.md#mfa-via-notifications-through-mobile-app) |Yes | MFA and SSPR |
29
−| [Authenticator Lite](/entra/identity/authentication/how-to-mfa-authenticator-lite) | No | MFA |
30
−| [Hardware OATH tokens (preview)](concept-authentication-oath-tokens.md#hardware-oath-tokens-preview) | No | MFA and SSPR |
31
−| [Software OATH tokens](concept-authentication-oath-tokens.md#software-oath-tokens) | No | MFA and SSPR |
32
−| [External MFA](/entra/identity/authentication/how-to-authentication-external-method-manage)| No | MFA |
33
−| [Temporary Access Pass (TAP)](howto-authentication-temporary-access-pass.md) | Yes | MFA |
34
−| [Short Message Service (SMS) sign-in](howto-authentication-sms-signin.md) | Yes | MFA and SSPR |
35
−| [Voice call](concept-authentication-phone-options.md) | No | MFA and SSPR |
36
−| [QR code](concept-authentication-qr-code.md) | Yes | No |
37
−| [Email OTP](concept-sspr-howitworks.md#authentication-methods) | No | SSPR and sign-in<sup>2</sup> |
38
−| Password | Yes | No |
23
+| Method | Primary authentication | Secondary authentication | SSPR / Account recovery |
24
+|---|---|---|---|
25
+| [Authenticator Lite](how-to-mfa-authenticator-lite) | No | MFA | No |
26
+| [Certificate-based authentication](concept-certificate-based-authentication) | Yes | MFA | No |
27
+| [Email OTP](concept-sspr-howitworks#authentication-methods) | No | SSPR and sign-in<sup>2</sup> | SSPR |
28
+| [External MFA](how-to-authentication-external-method-manage) | No | MFA | No |
29
+| [Hardware OATH tokens (preview)](concept-authentication-oath-tokens#hardware-oath-tokens-preview) | No | MFA | SSPR |
30
+| [Microsoft Authenticator passwordless](concept-authentication-authenticator-app#passwordless-sign-in-via-notifications) | Yes | No | No |
31
+| [Microsoft Authenticator push notifications](concept-authentication-authenticator-app#mfa-via-notifications-through-mobile-app) | Yes | MFA | SSPR |
32
+| [Passkey (FIDO2)](concept-authentication-passkeys-fido2) | Yes | MFA | No |
33
+| [Passkey in Microsoft Authenticator](concept-authentication-authenticator-app) | Yes | MFA | No |
34
+| Password | Yes | No | No |
35
+| [Platform Credential for macOS](concept-authentication-platform-credential-for-macos) | Yes | MFA | No |
36
+| [QR code](concept-authentication-qr-code) | Yes | No | No |
37
+| [SMS sign-in](howto-authentication-sms-signin) | Yes | MFA | SSPR |
38
+| [Software OATH tokens](concept-authentication-oath-tokens#software-oath-tokens) | No | MFA | SSPR |
39
+| [Synced passkey](concept-authentication-passkeys-fido2) | Yes | MFA | No |
40
+| [Temporary Access Pass (TAP)](howto-authentication-temporary-access-pass) | Yes | MFA | No |
41
+| [Verified ID](concept-authentication-verified-id.md)<sup>3</sup> | No | No | Account recovery |
42
+| [Voice call](concept-authentication-phone-options) | No | MFA | SSPR |
43
+| [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-overview) | Yes | MFA<sup>1</sup> | No |
3944
4045
<sup>1</sup>Windows Hello for Business can serve as a step-up MFA credential if a user is enabled for passkey (FIDO2) and has a passkey registered.
4146
42
−<sup>2</sup>Email OTP is available for tenant members for [self-service password reset (SSPR)](concept-sspr-howitworks.md#authentication-methods). You can also configure it for [sign-in by guest users](/entra/external-id/one-time-passcode).
47
+<sup>2</sup>Email OTP is available for tenant members for [self-service password reset (SSPR)](concept-sspr-howitworks#authentication-methods). You can also configure it for [sign-in by guest users](/entra/external-id/one-time-passcode).
4348
44
−## Phishing-resistant authentication methods
49
+<sup>3</sup>Verified ID is an identity verification capability, not a traditional authentication method. It provides proof of identity for account recovery but can't be used for sign-in, MFA, or SSPR.
4550
46
−While traditional MFA with SMS, email OTP, or authenticator apps significantly improves security over password-only systems, these options introduce friction—requiring additional steps for users, like entering codes, approving push notifications, or using authenticator apps. Moreover, these MFA options are prone to remote phishing attacks. In a remote phishing attack, attackers use social engineering and AI-driven tools to steal identity credentials—like passwords or one-time codes—without physical access to a user's device.
51
+## Phishing-resistant authentication methods
4752
48
−Microsoft recommends using phishing-resistant authentication methods such as Windows Hello for Business, passkeys (FIDO2) and FIDO2 security keys, or certificate-based authentication (CBA) because they provide the most secure sign-in experience.
53
+While traditional MFA with SMS, email OTP, or authenticator apps significantly improves security over password-only systems, these options introduce friction — requiring additional steps for users, like entering codes, approving push notifications, or using authenticator apps. Moreover, these MFA options are prone to remote phishing attacks. In a remote phishing attack, attackers use social engineering and AI-driven tools to steal identity credentials — like passwords or one-time codes — without physical access to a user's device.
4954
50
−The following phishing-resistant authentication methods are available in Microsoft Entra ID.
55
+Microsoft recommends using phishing-resistant authentication methods such as Windows Hello for Business, passkeys (FIDO2) and FIDO2 security keys, or certificate-based authentication (CBA) because they provide the most secure sign-in experience.
5156
57
+The following phishing-resistant authentication methods are available in Microsoft Entra ID:
58
+
5259
- Windows Hello for Business
5360
- Platform Credential for macOS
54
−- Synced passkeys (FIDO2)
61
+- Synced passkeys (FIDO2)
5562
- FIDO2 security keys
5663
- Passkeys in Microsoft Authenticator
57
−- Certificate-based authentication (CBA)
64
+- Certificate-based authentication (CBA)
5865
59
−## High-assurance account recovery
66
+## Verified ID identity verification
6067
61
−Account recovery is the process of helping users who lost all their credentials and can no longer access their account. Traditionally, a user calls the help desk, answers questions to verify their identity, and the help desk resets their credentials. Microsoft Entra ID now supports government-issued ID verification with AI-powered biometric matching for high-assurance account recovery.
68
+Verified ID is an identity verification capability in Microsoft Entra ID — not a traditional authentication method. It can't be used to satisfy authentication requirements like sign-in, MFA, or SSPR. Instead, Verified ID provides cryptographic proof of a user's verified identity for scenarios where trust must be re-established, such as account recovery when all authentication methods are lost.
6269
63
−Organizations can choose from the leading identity verification providers (IDV) through the [Microsoft Security Store](https://securitystore.microsoft.com/): Idemia, Lexis Nexis, and Au10tix. These partners offer coverage across 192 countries/regions and remote verification for most government-issued ID documents, including driver's licenses and passports. Microsoft Entra Verified ID Face Check, powered by Azure AI services, adds a critical layer of trust by matching a user’s real-time selfie to the photo from their identity document. By sharing only the match results and not any sensitive identity data, Face Check improves user privacy while allowing enterprises to verify that the person claiming an identity is who they claim to be.
70
+Identity verification profiles control which users can participate in Verified ID flows, which provider performs verification, and how identity claims are validated. Admins configure profiles through the Account Recovery setup wizard in the Microsoft Entra admin center, and the Verified ID policy page provides visibility into profile assignments and global exclusions.
6471
65
−Once enabled, this capability provides a natively integrated end-to-end flow for users to securely regain access to their accounts. For more information, see [Overview of Microsoft Entra ID account recovery](concept-account-recovery-overview.md).
72
+For more information, see [Verified ID identity verification overview](concept-authentication-verified-id.md).
6673
74
+## High-assurance account recovery
75
+
76
+Account recovery is the process of helping users who have lost all their credentials and can no longer access their account. Traditionally, a user calls the help desk, answers questions to verify their identity, and the help desk resets their credentials. Microsoft Entra ID now supports government-issued ID verification with biometric matching for high-assurance account recovery — removing the need for helpdesk intervention and eliminating social engineering risks.
77
+
78
+Organizations can choose from leading identity verification providers (IDV) through the [Microsoft Security Store](https://securitystore.microsoft.com/). These partners offer coverage across 192 countries/regions and remote verification for most government-issued ID documents, including driver's licenses and passports. Microsoft Entra Verified ID Face Check, powered by Azure AI services, verifies proof of presence by matching a user's real-time selfie to the photo from their identity document. Only the match result is shared — no sensitive identity data — which preserves user privacy while providing strong identity assurance.
79
+
6780
## Related content
6881
69
−* [Passkeys (FIDO2)](concept-authentication-passkeys-fido2.md)
70
−* [Get started with phishing-resistant MFA deployment in Microsoft Entra ID](how-to-plan-prerequisites-phishing-resistant-passwordless-authentication.md)
82
+- [Passkeys (FIDO2)](concept-authentication-passkeys-fido2)
83
+- [Verified ID identity verification overview](concept-authentication-verified-id.md)
84
+- [Account recovery overview](concept-account-recovery-overview.md)
85
+- [Enable and configure account recovery](how-to-account-recovery-enable.md)
86
+- [Get started with phishing-resistant MFA deployment in Microsoft Entra ID](how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.