Authentication strengths
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8729515 · +6 −6 lines · also on GitHub
⋯ 4 unchanged lines
55
66
ms.service: entra-id
77
ms.subservice: authentication
8
−ms.topic: concept-article
8
+ms.topic: conceptual
99
ms.date: 03/04/2025
1010
1111
ms.author: justinha
⋯ 31 unchanged lines
4343
4444
For an example, the built-in **Phishing-resistant MFA strength** allows the following combinations:
4545
46
−- Windows Hello for Business
46
+- Windows Hello for Business / Platform Credential
4747
4848
Or
4949
⋯ 3 unchanged lines
5353
5454
- Microsoft Entra certificate-based authentication (Multifactor)
5555
56
−:::image type="content" border="true" source="./media/concept-authentication-strengths/authentication-strength-definitions.png" alt-text="Screenshot showing the phishing-resistant MFA strength definition.":::
56
+:::image type="content" border="true" source="./media/concept-authentication-strengths/authentication-strength-definitions.png" alt-text="Screenshot showing the phishing-resistant MFA strength definition." lightbox="./media/concept-authentication-strengths/authentication-strength-definitions.png":::
5757
58
+
59
+
5860
The combinations of authentication methods for each built-in authentication strength are listed in the following table. These combinations include methods that need to be registered by users and enabled in the Authentication methods policy or the legacy MFA settings policy.
5961
6062
- **MFA strength** - the same set of combinations that could be used to satisfy the **Require multifactor authentication** setting.
⋯ 3 unchanged lines
6466
|Authentication method combination |MFA strength | Passwordless MFA strength| Phishing-resistant MFA strength|
6567
|----------------------------------|-------------|-------------------------------------|-------------------------------------------|
6668
|FIDO2 security key| ✅ | ✅ | ✅ |
67
−|Windows Hello for Business| ✅ | ✅ | ✅ |
69
+|Windows Hello for Business / Platform Credential| ✅ | ✅ | ✅ |
6870
|Certificate-based authentication (Multi-Factor) | ✅ | ✅ | ✅ |
6971
|Microsoft Authenticator (Phone Sign-in)| ✅ | ✅ | |
7072
|Temporary Access Pass (One-time use AND Multi-use)| ✅ | | |
⋯ 36 unchanged lines
107109
For example, let's say a resource requires passkey (FIDO2) for the authentication strength, and a 1-hour sign-in frequency. 24 hours ago, a user signed in with passkey (FIDO2) to access the resource.
108110
109111
When the user unlocks their Windows device using Windows Hello for Business, they can access the resource again. Yesterday's sign-in satisfies the authentication strength requirement, and today's device unlock satisfies the sign-in frequency requirement.
110
−
111
−- **Authentication strength blade double representation** - Platform credentials, such as Windows Hello for Business and **Platform Credential for macOS** are both represented in authentication strength under **Windows Hello For Business**. To configure a custom authentication strength that allows the use of **Platform Credential for macOS**, use **Windows Hello For Business**.
112112
113113
## FAQ
114114
⋯ 18 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.