Agent Foskett Academy • Microsoft Entra • Module 2 • Lesson 15

Lesson 15 — Authentication Methods Policies in Microsoft Entra

Not every authentication method provides the same level of protection.

Microsoft Entra Authentication Methods Policies determine which sign-in methods users can register and use, who those methods are available to, and how stronger options such as Microsoft Authenticator, passkeys, FIDO2 security keys, Windows Hello for Business and Temporary Access Pass support a modern identity strategy.

This lesson explains how authentication methods are governed, how they work with Conditional Access and authentication strengths, and how Agent Foskett investigates weak or abused authentication methods.

MFA is only as strong as the method used to complete it.

Start Lesson Back to Microsoft Entra Academy

Agent Foskett Microsoft Entra Authentication Methods Policies lesson

What you will learn

This lesson explains how Microsoft Entra controls authentication method availability, registration and security.

Authentication Methods Policies

Passkeys and FIDO2

Temporary Access Pass

Authentication investigation

Learning objectives

After completing this lesson, you should be able to explain, configure and investigate Microsoft Entra authentication methods.

Describe the purpose of Authentication Methods Policies.
Compare common passwordless and multifactor methods.
Target methods to appropriate users and groups.
Explain how authentication strengths interact with Conditional Access.
Investigate suspicious registration and authentication activity.

The problem this solves

Requiring MFA does not guarantee that every user completes a strong authentication challenge.

Authentication Methods Policies help organisations reduce reliance on weak methods and move users toward secure, phishing-resistant sign-in.

What are Authentication Methods Policies?

Authentication Methods Policies are tenant-level controls that define which authentication methods are enabled and which users or groups may register and use them.

User attempts to register or authenticate ↓ Microsoft Entra identifies the user and target resource ↓ Authentication Methods Policy is evaluated ↓ Conditional Access and authentication strength are evaluated ↓ An allowed method is selected ↓ Authentication completes and access is granted

Policy scope

Methods can be enabled for all users or targeted groups, with exclusions used carefully for staged deployment or emergency access.

Strong targeting lets administrators pilot new methods before broad enforcement.

Registration and use

A method must normally be both permitted by policy and successfully registered before a user can use it.

Registration activity should be monitored because an attacker who controls a session may attempt to add a new method.

Authentication method comparison

Method	Typical use	Security consideration
Password	Primary credential for traditional sign-in.	Vulnerable to phishing, reuse and credential theft.
SMS or voice	Second factor or recovery option.	Susceptible to social engineering, interception and SIM-swap attacks.
Microsoft Authenticator	Push, number matching and passwordless phone sign-in.	Strong when hardened, but users must still resist unsolicited prompts.
Windows Hello for Business	Passwordless sign-in tied to a managed device.	Uses device-bound keys protected by the device and user gesture.
Passkey or FIDO2 security key	Phishing-resistant passwordless authentication.	Strong protection because the credential is bound to the legitimate service.
Temporary Access Pass	Bootstrap or recover strong authentication methods.	Must be short-lived, tightly controlled and issued only after identity verification.

Microsoft Authenticator

Microsoft Authenticator can provide push notifications, number matching, passwordless phone sign-in and verification codes.

Number matching and additional context make accidental approval less likely, but user awareness and sign-in monitoring remain essential.

Authenticator registration controls

Administrators should target registration deliberately, use registration campaigns where appropriate and review users who add or replace Authenticator methods unexpectedly.

Device loss and account recovery processes should be documented before broad rollout.

FIDO2 security keys

FIDO2 security keys use public-key cryptography and are designed to resist phishing.

They are especially useful for privileged administrators, high-risk users and environments where mobile devices are unsuitable.

Passkeys

Passkeys provide passwordless authentication using cryptographic credentials stored on or synchronised between supported devices.

Deployment should consider device ownership, recovery, synchronisation behaviour and the organisation's authentication-strength requirements.

Windows Hello for Business

Windows Hello for Business replaces reusable passwords with a device-bound key unlocked by a PIN or biometric gesture.

The PIN is local to the device and does not travel across the network like a password.

Temporary Access Pass

Temporary Access Pass is a time-limited credential used to bootstrap passwordless authentication or recover access when a strong method is unavailable.

It should be issued only after reliable identity verification and configured with the shortest practical lifetime.

Authentication Methods Policy and Conditional Access

Control	What it decides	Example
Authentication Methods Policy	Which methods a user may register and use.	Enable FIDO2 for administrators and Microsoft Authenticator for employees.
Conditional Access	When additional authentication or access controls are required.	Require MFA when accessing sensitive applications from outside trusted locations.
Authentication strength	Which combinations or classes of methods satisfy a policy.	Require phishing-resistant MFA for privileged roles.

SMS authentication

SMS remains familiar and accessible, but it provides weaker protection than phishing-resistant methods.

Organisations should avoid relying on SMS for privileged accounts and should plan migration to stronger options.

Voice authentication

Voice calls may support users who cannot use other methods, but they are exposed to forwarding, social engineering and telephony risks.

Use them only where justified and monitor enrolment and usage.

Email one-time passcode

Email OTP can support some external collaboration scenarios when a guest does not authenticate through another identity provider.

It should not be treated as equivalent to phishing-resistant authentication for sensitive internal access.

Registration campaigns

Registration campaigns can prompt users to enrol in stronger methods such as Microsoft Authenticator.

A successful campaign includes communication, support, staged targeting and reporting on completion and failure rates.

Authentication investigation process

1. Identify the user, method and sign-in event ↓ 2. Review authentication method registration activity ↓ 3. Confirm whether the method was expected and user-approved ↓ 4. Examine sign-in logs, authentication details and Conditional Access ↓ 5. Review risky-user and risky-sign-in detections ↓ 6. Check for newly added devices, methods or recovery information ↓ 7. Revoke suspicious methods and sessions ↓ 8. Restore access using a controlled recovery process

Real-world scenario: the user kept approving MFA

1. A user's password is captured through phishing ↓ 2. The attacker repeatedly triggers push notifications ↓ 3. The user approves one request to stop the prompts ↓ 4. The attacker completes sign-in and establishes a session ↓ 5. Agent Foskett reviews authentication details and prompt history ↓ 6. The session is revoked and the account is secured ↓ 7. Microsoft Authenticator settings and Conditional Access are hardened ↓ 8. The user is moved toward phishing-resistant authentication

Evidence to review

Authentication method used and authentication requirement.
Registration and deletion events.
Device, IP address, location and application.
Conditional Access and authentication-strength results.
Risk detections and session activity.
User confirmation of legitimate registration.

Immediate containment

Revoke active sessions and reset compromised credentials.
Remove unfamiliar authentication methods.
Require re-registration where appropriate.
Issue Temporary Access Pass only through a verified recovery process.
Review downstream application access.
Preserve sign-in and audit evidence.

Common mistakes

Mistake	Why it creates risk	Better practice
Allowing weak methods for privileged users	High-value accounts remain exposed to phishing and telephony attacks.	Require phishing-resistant authentication for privileged roles.
Enabling every method for everyone	Users can fall back to the weakest available option.	Target methods according to role, device and risk.
No registration monitoring	An attacker may add a method without immediate detection.	Review registration events and alert on unusual changes.
Long-lived Temporary Access Pass	A recovery credential may remain useful after onboarding is complete.	Use the shortest practical lifetime and one-time use where appropriate.
No migration plan	Users remain dependent on SMS or voice indefinitely.	Use staged campaigns to move users to stronger methods.
Confusing MFA with phishing resistance	Some MFA methods can still be phished or socially engineered.	Use authentication strengths to require resistant methods where needed.

Key takeaways

Authentication Methods Policies control which methods users can register and use.
MFA strength depends on the method selected.
Passkeys, FIDO2 security keys and Windows Hello for Business provide phishing-resistant or device-bound authentication.
Microsoft Authenticator should be configured and monitored carefully.
Temporary Access Pass supports secure onboarding and recovery when tightly controlled.
SMS and voice should be reduced where stronger options are practical.
Conditional Access and authentication strengths determine when stronger methods are required.
Unexpected method registration should be treated as a potential account-compromise indicator.

Related Agent Foskett resources

Continue developing Microsoft Entra authentication, Conditional Access and investigation skills.

Lesson 14 — App Registrations in Microsoft Entra Lesson 4 — MFA and Authentication Methods Lesson 3 — Conditional Access Fundamentals Lesson 5 — Risky Users and Risky Sign-ins OAuth Consent Grant Investigation Microsoft Identity and Access Services

Continue learning

Continue through Microsoft Entra authentication security, or return to the academy roadmap.

⬅ Previous lesson

Lesson 14 — App Registrations in Microsoft EntraUnderstand application objects, credentials, redirect URIs and API permissions.

🏠 Academy home

Microsoft Entra AcademyReview the roadmap and continue through the identity security learning path.

📘 Next lesson

Lesson 16 — Authentication Strengths in Microsoft EntraLearn how Conditional Access requires specific classes of strong authentication.

Microsoft Entra Authentication Methods Policies and Passwordless Authentication

Microsoft Entra Authentication Methods Policies control Microsoft Authenticator, FIDO2 security keys, passkeys, Windows Hello for Business, Temporary Access Pass, SMS, voice and authentication registration.

Microsoft Entra Academy Lesson 15 — Authentication Methods Policies

This Agent Foskett lesson explains authentication method targeting, phishing-resistant MFA, registration campaigns, Conditional Access, authentication strengths and investigation of suspicious authentication changes.