Authentication strengths
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ca7cdfb · +6 −6 lines · also on GitHub
⋯ 16 unchanged lines
1717
1818
For example, an authentication strength can require users to use only phishing-resistant authentication methods to access a sensitive resource. To access a nonsensitive resource, administrators can create another authentication strength that allows less secure multifactor authentication (MFA) combinations, such as a password and a text message.
1919
20
−An authentication strength is based on the [policy for authentication method](concept-authentication-methods.md). That is, administrators can scope authentication methods for specific users and groups to be used across Microsoft Entra ID federated applications. An authentication strength allows further control over the usage of these methods, based on specific scenarios such as sensitive resource access, user risk, and location.
20
+An authentication strength is based on the [policy for authentication methods](concept-authentication-methods.md). That is, administrators can scope authentication methods for specific users and groups to be used across Microsoft Entra ID federated applications. An authentication strength allows further control over the usage of these methods, based on specific scenarios such as sensitive resource access, user risk, and location.
2121
2222
## Prerequisites
2323
⋯ 5 unchanged lines
2929
3030
- Require specific authentication methods to access a sensitive resource.
3131
- Require a specific authentication method when a user takes a sensitive action within an application (in combination with Conditional Access authentication context).
32
−- Require users to use a specific authentication method when they access sensitive applications outside of the corporate network.
32
+- Require users to use a specific authentication method when they access sensitive applications outside the corporate network.
3333
- Require more secure authentication methods for users at high risk.
3434
- Require specific authentication methods from guest users who access a resource tenant (in combination with cross-tenant settings).
3535
⋯ 46 unchanged lines
8282
8383
### Custom authentication strengths
8484
85
−Conditional Access administrators can also create custom authentication strengths to exactly suit their access requirements. For more information, see [Custom Conditional Access authentication strengths](concept-authentication-strength-advanced-options.md).
85
+Conditional Access administrators can also create custom authentication strengths to exactly suit their access requirements. For more information, see [Create and manage custom Conditional Access authentication strengths](concept-authentication-strength-advanced-options.md).
8686
8787
## Limitations
8888
⋯ 3 unchanged lines
9292
9393
- **Unsupported combination of grant controls**: You can't use the **Require multifactor authentication** and **Require authentication strength** grant controls together in the same Conditional Access policy. The reason is that the built-in **Multifactor authentication** authentication strength is equivalent to the **Require multifactor authentication** grant control.
9494
95
−- **Unsupported authentication method**: The **Email one-time pass (Guest)** authentication method isn't currently supported in the available combinations for authentication strengths.
95
+- **Unsupported authentication method**: The **Email one-time pass (Guest)** authentication method isn't currently supported in the available combinations.
9696
97
−- **Windows Hello for Business**: If the user signed in with Windows Hello for Business as the primary authentication method, it can be used to satisfy an authentication strength requirement that includes Windows Hello for Business. But if the user signed in with another method (like a password) as the primary authentication method, and the authentication strength requires Windows Hello for Business, the user isn't prompted to sign in with Windows Hello for Business. The user needs to restart the session, select **Sign-in options**, and select a method that the authentication strength requires.
97
+- **Windows Hello for Business**: If the user signs in with Windows Hello for Business as the primary authentication method, it can be used to satisfy an authentication strength requirement that includes Windows Hello for Business. But if the user signs in with another method (like a password) as the primary authentication method, and the authentication strength requires Windows Hello for Business, the user isn't prompted to sign in with Windows Hello for Business. The user needs to restart the session, select **Sign-in options**, and select a method that the authentication strength requires.
9898
9999
## Known issues
100100
101101
- **Authentication strength and sign-in frequency**: When a resource requires an authentication strength and a sign-in frequency, users can satisfy both requirements at two different times.
102102
103
− For example, let's say a resource requires a passkey (FIDO2) for the authentication strength, along with a 1-hour sign-in frequency. A user signed in with passkey (FIDO2) to access the resource 24 hours ago.
103
+ For example, let's say a resource requires a passkey (FIDO2) for the authentication strength, along with a 1-hour sign-in frequency. A user signed in with a passkey (FIDO2) to access the resource 24 hours ago.
104104
105105
When the user unlocks their Windows device by using Windows Hello for Business, they can access the resource again. Yesterday's sign-in satisfies the authentication strength requirement, and today's device unlock satisfies the sign-in frequency requirement.
106106
⋯ 17 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.