Lesson 4 — MFA and Authentication Methods
Multifactor authentication strengthens identity security by requiring more than one form of proof before access is granted.
Microsoft Entra supports passwords, Microsoft Authenticator, passkeys, FIDO2 security keys, Windows Hello for Business, certificate-based authentication, Temporary Access Pass and other methods for different users and security needs.
This lesson explains how the methods differ, why phishing resistance matters, how authentication strengths enforce stronger methods and how analysts investigate MFA activity without assuming every successful challenge was legitimate.
What you will learn
This lesson explains how Microsoft Entra authentication methods provide different levels of identity assurance.
Learning objectives
After completing this lesson, you should be able to compare Microsoft Entra authentication methods and select stronger controls.
- Explain authentication factors and multifactor authentication.
- Compare common Microsoft Entra authentication methods.
- Identify phishing-resistant methods.
- Explain authentication strengths and Temporary Access Pass.
- Investigate suspicious MFA and method-registration activity.
The problem this solves
Passwords can be guessed, reused, phished or stolen.
Authentication methods provide stronger proof of identity and allow Conditional Access to require methods appropriate to the sensitivity of the application or user.
What is multifactor authentication?
Multifactor authentication requires evidence from more than one authentication factor.
The factors are usually something the user knows, something the user has and something the user is.
Two prompts do not automatically mean two factors. The authentication method must provide independent proof from distinct factor categories.
Password authentication
A password is a knowledge factor and remains widely used.
It is vulnerable to phishing, reuse, password spraying and credential theft, so it should not be the only protection for cloud access.
Microsoft Authenticator
Microsoft Authenticator supports push notifications, number matching, one-time passcodes and passwordless phone sign-in.
Number matching reduces accidental approval, but users can still be socially engineered into approving an attacker-generated request.
Common authentication methods compared
| Method | Typical use | Security considerations |
|---|---|---|
| Password | Primary knowledge-based sign-in. | Phishable and vulnerable to reuse or theft. |
| Authenticator push | MFA approval with number matching and context. | Stronger than password alone but still exposed to social engineering. |
| OATH code | Time-based one-time passcode from an app or token. | Can be phished and replayed within the valid time window. |
| SMS or voice | Fallback or legacy MFA scenario. | Weaker due to SIM swap, interception and social engineering risk. |
| Passkey or FIDO2 key | Passwordless, cryptographic sign-in. | Phishing-resistant because credentials are bound to the legitimate service. |
| Windows Hello for Business | Device-bound passwordless sign-in using PIN or biometrics. | Phishing-resistant and backed by asymmetric keys. |
Passkeys
Passkeys use FIDO2 public-key cryptography instead of a shared secret.
Microsoft Entra can support passkeys stored on a device, synced through a supported credential provider or held on a FIDO2 security key.
FIDO2 security keys
A FIDO2 security key is a physical authenticator that stores a private key and requires a user gesture such as a PIN or biometric.
The key signs a challenge for the legitimate service, making the method resistant to credential phishing.
Why passkeys resist phishing
Windows Hello for Business
Windows Hello for Business replaces passwords with strong two-factor authentication tied to a device.
The user unlocks a device-bound credential using a PIN or biometric, while the private key remains protected on the endpoint.
Certificate-based authentication
Microsoft Entra certificate-based authentication allows users to authenticate with X.509 certificates.
It can support strong and phishing-resistant scenarios when certificate issuance, storage, revocation and user mapping are governed correctly.
Phishing-resistant authentication
Phishing-resistant methods create a cryptographic relationship with the legitimate sign-in service and cannot simply be copied into an attacker-controlled page.
| Method | Phishing-resistant? | Why |
|---|---|---|
| Passkey / FIDO2 | Yes | Public-key authentication is bound to the legitimate relying party. |
| Windows Hello for Business | Yes | Uses a device-bound asymmetric key unlocked locally. |
| Certificate-based authentication | Yes, when configured appropriately | Uses certificate-backed cryptographic authentication. |
| Authenticator push | No | A user can still be tricked into approving an attacker's request. |
| SMS or OATH code | No | The code can be captured and relayed to the real sign-in service. |
Temporary Access Pass
A Temporary Access Pass is a time-limited passcode that can be configured for one-time or reusable access.
It is commonly used to bootstrap registration of passwordless methods when the user does not yet have a strong authentication method.
TAP lifecycle
TAP should be issued through a verified recovery or onboarding process, limited in duration and monitored.
It is not intended to become a permanent daily authentication method.
Passwordless onboarding workflow
Authentication methods policy
The authentication methods policy controls which methods are available and which users or groups can use them.
Organisations should target methods deliberately, pilot changes and remove weaker methods when stronger alternatives are established.
System-preferred authentication
System-preferred authentication prompts users with the strongest method they have registered when Microsoft Entra selects the MFA method.
This helps move users away from weaker methods without relying only on their manually selected default.
Authentication strengths
Conditional Access authentication strengths restrict which method combinations can satisfy an authentication requirement.
Microsoft Entra provides built-in strengths for multifactor authentication, passwordless MFA and phishing-resistant MFA, and organisations can define custom strengths.
| Built-in strength | Purpose |
|---|---|
| Multifactor authentication strength | Allows supported MFA combinations, including methods that may still be phishable. |
| Passwordless MFA strength | Requires supported passwordless combinations. |
| Phishing-resistant MFA strength | Requires supported cryptographic methods that resist phishing. |
Why authentication strengths matter
A basic “require MFA” control may permit methods that are not suitable for privileged administration or sensitive data.
Authentication strengths let the organisation require phishing-resistant methods for high-risk users and applications.
Registration campaigns
Registration campaigns can prompt users to register stronger methods such as Microsoft Authenticator.
Rollouts should include user communication, support procedures, accessibility considerations and recovery planning.
How MFA appears in sign-in logs
“MFA requirement satisfied” does not always mean the user received a fresh prompt during that sign-in. Review the detailed authentication steps and token claims.
MFA fatigue
MFA fatigue occurs when an attacker repeatedly triggers push requests hoping the user will approve one.
Number matching, context display, stronger methods and user education reduce the risk, but suspicious approvals still require investigation.
Session and token theft
MFA does not prevent every form of account takeover.
An attacker may steal a session token after authentication, so analysts must review device, application, token and post-sign-in activity.
Authentication investigation workflow
The method proves how the sign-in was completed. The investigation determines who controlled the method.
Suspicious method registration
An attacker with temporary account access may register a new authentication method for persistence.
Review registration timestamps, administrator actions, device context and whether the user expected the change.
Recovery and containment
Containment may include revoking sessions, resetting the password, removing untrusted methods, issuing a new TAP and re-registering strong authentication.
Follow organisational identity-verification procedures before changing methods.
Example investigation
Common mistakes
| Mistake | Why it creates risk | Better practice |
|---|---|---|
| Treating every MFA method as equal | Phishable methods may be accepted for sensitive access. | Use authentication strengths and phishing-resistant methods. |
| Leaving SMS as the primary method indefinitely | SIM swap and interception risks remain. | Move users toward passkeys, FIDO2 or Windows Hello. |
| Issuing long-lived Temporary Access Passes | The bootstrap credential becomes an extended access path. | Use short duration, verified issuance and monitoring. |
| Assuming successful MFA proves legitimacy | Users can approve malicious prompts or attackers can steal sessions. | Review context, method ownership and post-sign-in activity. |
Key takeaways
- MFA requires independent authentication factors.
- Microsoft Entra supports methods with different security and usability characteristics.
- Passkeys, FIDO2, Windows Hello and appropriate certificate-based authentication are phishing-resistant.
- Temporary Access Pass supports controlled passwordless onboarding and recovery.
- Authentication strengths can require stronger method combinations through Conditional Access.
- A successful MFA event must still be investigated in context.
Related Agent Foskett resources
Continue learning
Microsoft Entra MFA and Authentication Methods
Microsoft Entra supports Microsoft Authenticator, passkeys, FIDO2 security keys, Windows Hello for Business, certificate-based authentication, Temporary Access Pass and other authentication methods.
Microsoft Entra Academy Lesson 4 — MFA and Authentication Methods
This Agent Foskett Microsoft Entra Academy lesson explains multifactor authentication, phishing-resistant methods, authentication strengths, passwordless onboarding and MFA investigation.
