ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Authentication strengths

This page's changes and edits · All guidance changes

Microsoft's edit ·

edit pass: conditional-access-authentication-strength

Microsoft's commit message in MicrosoftDocs/entra-docs · commit d25b489 · +54 −63 lines · also on GitHub

11 ---
2 −title: Overview of Microsoft Entra authentication strength
3 −description: Learn how admins can use Microsoft Entra Conditional Access to distinguish which authentication methods can be used based on relevant security factors.
4 −
5 −
2 +title: Overview of Microsoft Entra Authentication Strengths
3 +description: Learn how admins can use Microsoft Entra Conditional Access to distinguish which authentication methods users can use based on relevant security factors.
64 ms.service: entra-id
75 ms.subservice: authentication
86 ms.topic: concept-article
97 ms.date: 03/04/2025
10 −
118 ms.author: justinha
129 author: inbarckms
1310 manager: dougeby
1411 ms.reviewer: inbarc
1512 ---
16 −# Conditional Access authentication strength
1713
18 −Authentication strength is a Conditional Access control that specifies which combinations of authentication methods can be used to access a resource. Users can satisfy the strength requirements by authenticating with any of the allowed combinations.
14 +# Conditional Access authentication strengths
1915
20 −For example, an authentication strength can require that only phishing-resistant authentication methods be used to access a sensitive resource. To access a nonsensitive resource, administrators can create another authentication strength that allows less secure multifactor authentication (MFA) combinations, such as password + text message.
16 +An authentication strength is a Microsoft Entra Conditional Access control that specifies which combinations of authentication methods users can use to access a resource. Users can satisfy the strength requirements by authenticating with any of the allowed combinations.
2117
22 −Authentication strength is based on the [Authentication methods policy](concept-authentication-methods.md), where administrators can scope authentication methods for specific users and groups to be used across Microsoft Entra ID federated applications. Authentication strength allows further control over the usage of these methods based upon specific scenarios such as sensitive resource access, user risk, location, and more.
18 +For example, an authentication strength can require that users can use only phishing-resistant authentication methods to access a sensitive resource. To access a nonsensitive resource, administrators can create another authentication strength that allows less secure multifactor authentication (MFA) combinations, such as a password and a text message.
2319
20 +An authentication strength is based on the [policy for authentication method](concept-authentication-methods.md). That is, administrators can scope authentication methods for specific users and groups to be used across Microsoft Entra ID federated applications. An authentication strength allows further control over the usage of these methods, based on specific scenarios such as sensitive resource access, user risk, and location.
21 +
22 +## Prerequisites
23 +
24 +- To use Conditional Access, your tenant needs to have Microsoft Entra ID P1 license. If you don't have this license, you can start a [free trial](https://www.microsoft.com/security/business/get-started/start-free-trial).
25 +
2426 ## Scenarios for authentication strengths
2527
26 −Authentication strengths can help customers address these scenarios:
28 +Authentication strengths can help customers address these scenarios:
2729
2830 - Require specific authentication methods to access a sensitive resource.
2931 - Require a specific authentication method when a user takes a sensitive action within an application (in combination with Conditional Access authentication context).
3032 - Require users to use a specific authentication method when they access sensitive applications outside of the corporate network.
31 −- Require more secure authentication methods for users at high risk.
32 −- Require specific authentication methods from guest users who access a resource tenant (in combination with cross-tenant settings). <!-- Namrata - Add / review external users scenario here -->
33 +- Require more secure authentication methods for users at high risk.
34 +- Require specific authentication methods from guest users who access a resource tenant (in combination with cross-tenant settings).
3335
34 −## Authentication strengths
36 +## Built-in and custom authentication strengths
3537
36 −Administrators can specify an authentication strength to access a resource by creating a Conditional Access policy with the **Require authentication strength** control. They can choose from three built-in authentication strengths: **Multifactor authentication strength**, **Passwordless MFA strength**, and **Phishing-resistant MFA strength**. They can also create a custom authentication strength based on the authentication method combinations they want to allow.
38 +Administrators can specify an authentication strength to access a resource by creating a Conditional Access policy with the **Require authentication strength** control. They can choose from three built-in authentication strengths: **Multifactor authentication strength**, **Passwordless MFA strength**, and **Phishing-resistant MFA strength**. They can also create a custom authentication strength based on the authentication method combinations that they want to allow.
3739
3840 :::image type="content" border="true" source="./media/concept-authentication-strengths/conditional-access-policy-authentication-strength-grant-control.png" alt-text="Screenshot of a Conditional Access policy with an authentication strength configured in grant controls.":::
3941
4042 ### Built-in authentication strengths
4143
42 −Built-in authentication strengths are combinations of authentication methods that are predefined by Microsoft. Built-in authentication strengths are always available and can't be modified. Microsoft will update built-in authentication strengths when new methods become available.
43 −
44 −For an example, the built-in **Phishing-resistant MFA strength** allows the following combinations:
45 −
46 −- Windows Hello for Business / Platform Credential
44 +Built-in authentication strengths are combinations of authentication methods that Microsoft predefines. Built-in authentication strengths are always available and can't be modified. Microsoft updates built-in authentication strengths when new methods become available.
4745
48 − Or
46 +For example, the built-in **Phishing-resistant MFA strength** authentication strength allows combinations of:
4947
48 +- Windows Hello for Business or platform credential
5049 - FIDO2 security key
51 −
52 − Or
53 −
54 −- Microsoft Entra certificate-based authentication (Multifactor)
55 −
56 −:::image type="content" border="true" source="./media/concept-authentication-strengths/authentication-strength-definitions.png" alt-text="Screenshot showing the phishing-resistant MFA strength definition." lightbox="./media/concept-authentication-strengths/authentication-strength-definitions.png":::
57 −
50 +- Microsoft Entra certificate-based authentication (multifactor)
5851
52 +:::image type="content" border="true" source="./media/concept-authentication-strengths/authentication-strength-definitions.png" alt-text="Screenshot that shows the definition of the authentication strength for phishing-resistant multifactor authentication." lightbox="./media/concept-authentication-strengths/authentication-strength-definitions.png":::
5953
60 −The combinations of authentication methods for each built-in authentication strength are listed in the following table. These combinations include methods that need to be registered by users and enabled in the Authentication methods policy or the legacy MFA settings policy.
54 +The following table lists combinations of authentication methods for each built-in authentication strength. These combinations include methods that users need to register and that admins need to enable in the policy for authentication methods or the policy for legacy MFA settings:
6155
62 −- **MFA strength** - the same set of combinations that could be used to satisfy the **Require multifactor authentication** setting.
63 −- **Passwordless MFA strength** - includes authentication methods that satisfy MFA but don't require a password.
64 −- **Phishing-resistant MFA strength** - includes methods that require an interaction between the authentication method and the sign-in surface.
56 +- **MFA strength**: The same set of combinations that can be used to satisfy the **Require multifactor authentication** setting.
57 +- **Passwordless MFA strength**: Includes authentication methods that satisfy MFA but don't require a password.
58 +- **Phishing-resistant MFA strength**: Includes methods that require an interaction between the authentication method and the sign-in surface.
6559
6660 |Authentication method combination |MFA strength | Passwordless MFA strength| Phishing-resistant MFA strength|
6761 |----------------------------------|-------------|-------------------------------------|-------------------------------------------|
6862 |FIDO2 security key| &#x2705; | &#x2705; | &#x2705; |
69 −|Windows Hello for Business / Platform Credential| &#x2705; | &#x2705; | &#x2705; |
70 −|Certificate-based authentication (Multi-Factor) | &#x2705; | &#x2705; | &#x2705; |
71 −|Microsoft Authenticator (Phone Sign-in)| &#x2705; | &#x2705; | |
72 −|Temporary Access Pass (One-time use AND Multi-use)| &#x2705; | | |
73 −|Password + something you have<sup>1</sup>| &#x2705; | | |
74 −|Federated single-factor + something you have<sup>1</sup>| &#x2705; | | |
75 −|Federated Multi-Factor| &#x2705; | | |
63 +|Windows Hello for Business or platform credential| &#x2705; | &#x2705; | &#x2705; |
64 +|Certificate-based authentication (multifactor) | &#x2705; | &#x2705; | &#x2705; |
65 +|Microsoft Authenticator (phone sign-in)| &#x2705; | &#x2705; | |
66 +|Temporary Access Pass (one-time use and multiple use)| &#x2705; | | |
67 +|Password plus something the user has<sup>1</sup>| &#x2705; | | |
68 +|Federated single-factor plus something the user has<sup>1</sup>| &#x2705; | | |
69 +|Federated multifactor| &#x2705; | | |
7670 |Certificate-based authentication (single-factor)| | | |
7771 |SMS sign-in | | | |
7872 |Password | | | |
7973 |Federated single-factor| | | |
8074
81 −<!-- We will move these methods back to the table as they become supported - expected very soon
82 −|Email One-time pass (Guest)| | | |
83 −-->
84 −
85 −<sup>1</sup> Something you have refers to one of the following methods: text message, voice, push notification, software OATH token, or hardware OATH token.
75 +<sup>1</sup> *Something the user has* refers to one of the following methods: text message, voice, push notification, software OATH token, or hardware OATH token.
8676
87 −The following API call can be used to list definitions of all the built-in authentication strengths:
77 +You can use the following API call to list definitions of all the built-in authentication strengths:
8878
8979 ```http
9080 GET https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrength/policies?$filter=policyType eq 'builtIn'
9181 ```
9282
93 −Conditional Access Administrators can also create custom authentication strengths to exactly suit their access requirements. For more information, see [Custom Conditional Access authentication strengths](concept-authentication-strength-advanced-options.md).
83 +### Custom authentication strengths
9484
85 +Conditional Access administrators can also create custom authentication strengths to exactly suit their access requirements. For more information, see [Custom Conditional Access authentication strengths](concept-authentication-strength-advanced-options.md).
86 +
9587 ## Limitations
9688
97 −- **Conditional Access policies are only evaluated after the initial authentication** - As a result, authentication strength doesn't restrict a user's initial authentication. Suppose you are using the built-in phishing-resistant MFA strength. A user can still type in their password, but they are required to sign in with a phishing-resistant method such as FIDO2 security key before they can continue.
89 +- **Effect of an authentication strength on authentication**: Conditional Access policies are evaluated only after the initial authentication. As a result, an authentication strength doesn't restrict a user's initial authentication.
9890
99 −- **Require multifactor authentication and Require authentication strength can't be used together in the same Conditional Access policy** - These two Conditional Access grant controls can't be used together because the built-in authentication strength **Multifactor authentication** is equivalent to the **Require multifactor authentication** grant control.
91 + Suppose you're using the built-in **Phishing-resistant MFA strength** authentication strength. A user can still enter a password but must sign in by using a phishing-resistant method, such as a FIDO2 security key, before they can continue.
10092
101 −- **Authentication methods that aren't currently supported by authentication strength** - The **Email one-time pass (Guest)** authentication method isn't included in the available combinations.
93 +- **Unsupported combination of grant controls**: You can't use the **Require multifactor authentication** and **Require authentication strength** grant controls together in the same Conditional Access policy. The reason is that the built-in **Multifactor authentication** authentication strength is equivalent to the **Require multifactor authentication** grant control.
10294
103 −- **Windows Hello for Business** – If the user signed in with Windows Hello for Business as their primary authentication method, it can be used to satisfy an authentication strength requirement that includes Windows Hello for Business. However, if the user signed in with another method like password as their primary authentication method, and the authentication strength requires Windows Hello for Business, they aren't prompted to sign in with Windows Hello for Business. The user needs to restart the session, choose **Sign-in options**, and select a method required by the authentication strength.
95 +- **Unsupported authentication method**: The **Email one-time pass (Guest)** authentication method isn't currently supported in the available combinations for authentication strengths.
10496
97 +- **Windows Hello for Business**: If the user signed in with Windows Hello for Business as the primary authentication method, it can be used to satisfy an authentication strength requirement that includes Windows Hello for Business. But if the user signed in with another method (like a password) as the primary authentication method, and the authentication strength requires Windows Hello for Business, the user isn't prompted to sign in with Windows Hello for Business. The user needs to restart the session, select **Sign-in options**, and select a method that the authentication strength requires.
98 +
10599 ## Known issues
106100
107 −- **Authentication strength and sign-in frequency** - When a resource requires an authentication strength and a sign-in frequency, users can satisfy both requirements at two different times.
101 +- **Authentication strength and sign-in frequency**: When a resource requires an authentication strength and a sign-in frequency, users can satisfy both requirements at two different times.
108102
109 − For example, let's say a resource requires passkey (FIDO2) for the authentication strength, and a 1-hour sign-in frequency. 24 hours ago, a user signed in with passkey (FIDO2) to access the resource.
103 + For example, let's say a resource requires a passkey (FIDO2) for the authentication strength, along with a 1-hour sign-in frequency. A user signed in with passkey (FIDO2) to access the resource 24 hours ago.
110104
111 − When the user unlocks their Windows device using Windows Hello for Business, they can access the resource again. Yesterday's sign-in satisfies the authentication strength requirement, and today's device unlock satisfies the sign-in frequency requirement.
105 + When the user unlocks their Windows device by using Windows Hello for Business, they can access the resource again. Yesterday's sign-in satisfies the authentication strength requirement, and today's device unlock satisfies the sign-in frequency requirement.
112106
113107 ## FAQ
114108
115 −### Should I use authentication strength or the Authentication methods policy?
116 −Authentication strength is based on the Authentication methods policy. The Authentication methods policy helps to scope and configure authentication methods to be used across Microsoft Entra ID by specific users and groups. Authentication strength allows another restriction of methods for specific scenarios, such as sensitive resource access, user risk, location, and more.
117 −
118 −For example, the administrator of Contoso wants to allow their users to use Microsoft Authenticator with either push notifications or passwordless authentication mode. The administrator goes to the Microsoft Authenticator settings in the Authentication methods policy, scopes the policy for the relevant users, and sets the **Authentication mode** to **Any**.
109 +### Should I use an authentication strength or the Authentication methods policy?
119110
120 −Then for Contoso's most sensitive resource, the administrator wants to restrict the access to only passwordless authentication methods. The administrator creates a new Conditional Access policy, using the built-in **Passwordless MFA strength**.
111 +An authentication strength is based on the **Authentication methods** policy. The **Authentication methods** policy helps to scope and configure authentication methods that users and groups can use across Microsoft Entra ID. An authentication strength allows another restriction of methods for specific scenarios, such as sensitive resource access, user risk, and location.
121112
122 −As a result, users in Contoso can access most of the resources in the tenant using password + push notification from the Microsoft Authenticator OR only using Microsoft Authenticator (phone sign-in). However, when the users in the tenant access the sensitive application, they must use Microsoft Authenticator (phone sign-in).
113 +For example, assume that the administrator of an organization named Contoso wants to allow users to use Microsoft Authenticator with either push notifications or passwordless authentication mode. The administrator goes to the Authenticator settings in the **Authentication methods** policy, scopes the policy for the relevant users, and sets **Authentication mode** to **Any**.
123114
124 −## Prerequisites
115 +For Contoso's most sensitive resource, the administrator wants to restrict the access to only passwordless authentication methods. The administrator creates a new Conditional Access policy by using the built-in **Passwordless MFA strength** authentication strength.
125116
126 −- **Microsoft Entra ID P1** - Your tenant needs to have Microsoft Entra ID P1 license to use Conditional Access. If needed, you can enable a [free trial](https://www.microsoft.com/security/business/get-started/start-free-trial).
117 +As a result, users in Contoso can access most of the resources in the tenant by using a password and a push notification from Authenticator, or by using only Authenticator (phone sign-in). However, when the users in the tenant access the sensitive application, they must use Authenticator (phone sign-in).
127118
128 −## Next steps
119 +## Related content
129120
130121 - [Custom Conditional Access authentication strengths](concept-authentication-strength-advanced-options.md)
131 −- [How authentication strength works for external users](concept-authentication-strength-external-users.md)
132 −- [Troubleshoot authentication strengths](troubleshoot-authentication-strengths.md)
122 +- [How authentication strengths work for external users](concept-authentication-strength-external-users.md)
123 +- [Troubleshoot authentication strengths](troubleshoot-authentication-strengths.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.