Secure Authentication, MFA, and Passwordless Technologies

radio_button_uncheckedshort_text Introduction

Authentication arose from the need to prove that a person was really who they claimed to be. In the earliest systems, that proof was almost always a password stored and compared by the computer. As corporate networks, internet services, and cloud applications expanded, a single memorized piece of information was no longer enough: passwords began to be reused, stolen through phishing, guessed by automated attacks, and exposed in breaches. This context drove multifactor authentication and, more recently, passwordless cryptographic credentials.

For the reader, understanding secure authentication means understanding the first barrier that protects accounts, data, and services. For society, stronger methods reduce fraud, account takeover, service disruption, and exposure of personal information. The topic also has a direct effect on productivity: well-designed authentication protects without turning every sign-in into a confusing process.

In this chapter, the central question will not just be “which method exists?”, but “which threat does it reduce, at which stage does it act, and which limitations remain?”. By the end, you will be able to analyze a sign-in in Microsoft Entra ID as a complete flow: method registration, identity proof, policy evaluation, token issuance, account recovery, and auditing.

radio_button_uncheckedshort_text 1. Authentication in the context of digital identity

Identification is the assertion of an identity, usually by username, email address, or UPN. Authentication is the process that verifies that assertion through a credential. Authorization comes afterward and determines which actions the authenticated identity can perform. Identity administration maintains accounts, methods, permissions, and lifecycle. Confusing these concepts leads to classic errors: a user can be authenticated correctly and still not be authorized to open a particular resource.

Key point

Authentication does not grant permission by itself. It provides a verified identity so that authorization controls, such as roles and policies, make the access decision.

radio_button_uncheckedshort_text 2. Brief evolution: from the password to phishing-resistant credentials

The password became dominant because it was cheap, simple to implement, and easy to carry between systems. However, its security depends on the human ability to create and protect a secret. Users tend to reuse patterns, and attackers exploit that predictability with brute force, password spray, credential stuffing, and phishing. Systems also had to evolve in how they store passwords, using hash functions and protection techniques instead of plaintext.

Multifactor authentication added a second category of proof. Then smartphones popularized notifications and temporary codes. The next step was to remove the password from the main flow and use asymmetric cryptography, with a private key protected on the device and a public key registered with the identity provider. FIDO2 , passkeys, and Windows Hello for Business belong to this evolution and offer superior resistance to fake login pages.

radio_button_uncheckedshort_text 3. Authentication factors

A factor is a category of evidence used to prove identity. The three classic factors are knowledge, possession, and inherence. MFA requires two or more independent factors; performing two verifications from the same category may increase friction, but it does not produce the same protection as a truly multifactor combination.

3.1 Something you know

Includes password, PIN, and other memorized information. The value of the factor depends on it being secret and hard to guess. In Windows Hello for Business and FIDO2 keys, the PIN is not a password sent to the server: it locally unlocks a private key bound to the authenticator. This difference is important for the SC-900.

3.2 Something you have

It is the possession of an authenticator, such as a registered phone, OATH token, smart card, or security key. Possession alone is not always enough; strong methods also require presence, PIN, or biometrics. A phone can receive SMS, generate TOTP, store a passkey , or approve a notification - these are different mechanisms using the same physical device.

3.3 Something you are

Biometrics represent physical or behavioral characteristics. In modern solutions, the fingerprint or face usually unlocks a local credential; the cloud service receives a cryptographic proof, not the biometric image. Thus, biometrics are usually part of an authenticator tied to the device, and not data sent to Microsoft Entra ID for centralized comparison.

3.4 Context signals are not automatically factors

Location, IP address, device compliance, risk, and behavior can influence a Conditional Access decision. They are important signals, but they must not be confused with the classic authentication factors. A policy can use these signals to require MFA , block sign-in, or accept a stronger method.

radio_button_uncheckedshort_text 4. Microsoft Entra ID authentication methods

Microsoft Entra ID offers methods for primary authentication, MFA , SSPR , and recovery. Not every method serves every purpose. A method can be accepted as a first factor, as a second factor, as recovery proof, or in more than one of these stages. The method policy defines which users and groups can register and use each option.

Caution

The table is conceptual and does not replace the official compatibility matrix. The exact use of each method for sign-in, MFA , SSPR , or recovery depends on policy, licensing, account type, and service updates.

radio_button_uncheckedshort_text 5. Passwords: operation, value, and limitations

The password remains present because it works on virtually any device and application. It belongs to the knowledge factor and can start a modern sign-in in Microsoft Entra ID. However, a strong password does not eliminate risks of phishing, malware, reuse, or leakage. Therefore, the recommended strategy is to combine password protection, MFA , and a progressive migration to passwordless and phishing-resistant methods.

5.1 A strong password is not the same as an impossible-to-compromise password

Length, unpredictability, and uniqueness make a password more resistant to guessing. Even so, a fake page can capture an excellent password. Likewise, a password reused on another service can be tested by credential stuffing. The defense must consider the attack method, not just complexity.

5.2 Password hashing and authentication

Secure services do not need to store passwords in plaintext. A hash function transforms the input into a derived value. In hybrid identity with Password Hash Synchronization, the process does not copy the readable password to the cloud; a hash derived from the Active Directory hash is synchronized to allow validation in Microsoft Entra ID. This topic was introduced in the previous chapter and connects to secure authentication.

radio_button_uncheckedshort_text 6. Microsoft Entra multifactor authentication

Microsoft Entra MFA requires an additional form of verification when a policy determines that the sign-in needs more trust. The requirement can be applied by security defaults , Conditional Access, risk policies, per-user configuration, or other integrations. The result is not simply “ask for a code”: the service evaluates the method used and whether it satisfies the defined requirement.

6.1 MFA and step-up authentication

A session can start with one level of trust and require additional authentication when the user attempts a sensitive action. This increase in assurance is called step-up authentication. For example, reading a portal may be allowed with the current session, while changing administrative settings requires an MFA method or a phishing-resistant authentication strength .

6.2 MFA does not mean a prompt on every sign-in

Policies can consider an existing session, sign-in frequency, device, risk, location, and application. Therefore, a user enabled for MFA does not always receive a challenge on every authentication. On the exam, “the user uses MFA ” means that the environment may require additional proof according to policy, not that every access necessarily shows two screens.

6.3 Per-user MFA , security defaults , and Conditional Access

radio_button_uncheckedshort_text 7. Microsoft Authenticator

Microsoft Authenticator is a mobile app for Android and iOS that can participate in MFA , SSPR , passwordless sign-in, and passkeys. The same app supports distinct mechanisms; therefore, it is important to identify which experience is being used in a question.

7.1 Push notifications for MFA

The user receives a request on the phone and approves or denies it. Number matching presents a number on the sign-in screen and requires the user to enter it in the app, reducing approvals by habit. Additional information, such as the application name and approximate location, helps recognize unexpected requests.

7.2 OATH TOTP verification codes

The app also generates time-based temporary codes. The code changes periodically and is entered in the sign-in interface. This method works even when the phone does not receive a data notification at that instant, because the code is computed locally from a shared secret and time.

7.3 Passwordless sign-in through the app

In phone sign-in, the user provides the identity and responds in the Authenticator using the registered device, PIN, or biometrics. Authentication is key-based, not the sending of a password. Passkeys in the Authenticator extend the FIDO2 experience and offer phishing resistance by binding authentication to the legitimate service.

7.4 MFA fatigue

In MFA fatigue attacks, the attacker already has the password and fires many requests hoping the user approves one of them. Number matching , request context, training, and blocking of suspicious sign-ins reduce this risk. The best control is to prevent methods that can be approved by mistake from being the only barrier to critical resources, using phishing-resistant authentication whenever possible.

radio_button_uncheckedshort_text 8. Temporary codes, OATH, and hardware tokens

OATH is a family of standards for one-time passwords. TOTP creates codes based on time; HOTP creates codes based on a counter. In Microsoft Entra environments, authenticator apps normally use TOTP. OATH hardware tokens produce codes without depending on a smartphone and can serve sectors with operational restrictions.

Important difference

A one-time code reduces direct reuse, but does not guarantee phishing resistance. An attacker in an intermediary position can capture and use an OTP in real time. FIDO2 avoids this problem by binding the cryptographic proof to the correct domain.

radio_button_uncheckedshort_text 9. SMS, voice calls, and phone-based authentication

SMS and voice are methods based on possession of the phone or registered number. They can be useful for inclusion, transition, and recovery, but they offer lower assurance than cryptographic methods. The number can be transferred fraudulently, calls can be redirected, and messages can be exposed on improperly locked devices.

Microsoft Entra can also offer SMS-based sign-in for specific scenarios, such as frontline workers: the user signs in with a registered number and code, without a traditional password. This mode is different from using SMS only as a second factor after a password. For sensitive resources, Microsoft recommends migrating to phishing-resistant methods, such as FIDO2 , Windows Hello for Business, or certificate-based authentication.

radio_button_uncheckedshort_text 10. What passwordless authentication means

Passwordless authentication removes the password from the main flow. Instead of proving knowledge of a shared secret, the user proves possession of a private key and performs a local gesture, such as a PIN, biometrics, or a touch. The server registers the public key and validates a signature over a challenge. The private key remains protected in the authenticator.

Passwordless does not mean single-factor authentication. Windows Hello for Business, Authenticator, and FIDO2 normally combine possession of the device or key with a PIN or biometrics. The experience is simpler because the user does not type a reusable password, while security is superior because there is no shared secret that can be captured by a fake page.

radio_button_uncheckedshort_text 11. Windows Hello for Business

Windows Hello for Business replaces passwords on Windows devices with strong key-based authentication. During provisioning, a public key is associated with the identity and the private key is protected on the device, often with a TPM. The user unlocks that key with a PIN or biometrics. The PIN is local to the device: knowing the PIN without possessing the equipment does not allow authentication on another computer.

11.1 Biometrics and PIN as local gestures

The fingerprint or facial recognition does not travel to Microsoft Entra ID. They unlock the local cryptographic material. The PIN works as an alternative or a local recovery requirement. This architecture limits the value of captured data: there is no universal password reusable across many services.

11.2 Relationship with SSO

After signing in to Windows, the device can obtain tokens that provide single sign-on to corporate applications. The user experiences fewer prompts, but the organization continues to apply identity policies, device compliance, and authorization.

radio_button_uncheckedshort_text 12. FIDO2 security keys and passkeys

FIDO2 combines WebAuthn and CTAP for authentication with public-key cryptography. A physical security key can be connected by USB, NFC, or another compatible means. A passkey is a key-based FIDO credential that can reside on a device, manager, or compatible application. In Microsoft Entra, the passkey / FIDO2 policy controls registration and use.

12.1 Why FIDO2 is phishing-resistant

The credential is bound to the correct site or relying party. A fake page on a different domain cannot request a valid signature for the legitimate domain. In addition, the private key is not transmitted. This reduces traditional phishing and adversary-in-the-middle attacks that rely on capturing password and OTP.

12.2 Physical key versus platform passkey

The physical key is portable and useful on shared computers. A platform passkey can remain protected by the hardware and the device account. The choice depends on the user profile, recovery requirements, portability, and organizational policy. For the SC-900, the central point is that both use FIDO2 and eliminate the reusable password from the flow.

radio_button_uncheckedshort_text 13. Biometrics: benefits and cautions

Biometrics improve convenience because the user does not need to memorize a complex secret. However, biometric data cannot be “changed” like a password. Therefore, secure architectures avoid sending biometric templates to the identity provider and use them to unlock a locally protected key.

Biometrics must also have an alternative, such as a PIN, for accessibility and sensor failures. Organizations need to consider privacy, device protection, sensor quality, and local policies. In Microsoft Entra, the service normally receives the key proof, not the raw biometric data.

radio_button_uncheckedshort_text 14. Temporary Access Pass - TAP

The Temporary Access Pass is a time-limited credential, configurable for one-time use or multiple sign-ins within a period. It solves a bootstrap problem: how to register a strong passwordless method when the user does not yet have MFA configured? The administrator issues a TAP , the user signs in, and registers FIDO2 , Windows Hello for Business, or another allowed method.

TAP also assists recovery when the strong authenticator was lost. Because it is temporary, it should be issued with minimal duration, delivered through a trusted channel, and audited. It does not permanently replace the normal methods and should not be treated as a static password.

radio_button_uncheckedshort_text 15. Method policy and authentication strengths

The authentication methods policy allows enabling options for specific groups and configuring parameters. This helps migrate from weak to strong methods without releasing everything to everyone at once. Combined registration allows MFA and SSPR information to be administered in a single security information experience.

15.1 Authentication strengths

An authentication strength is a Conditional Access control that specifies which methods or combinations satisfy the policy. One rule may require “ MFA ” in general, while another requires phishing-resistant methods. Thus, the organization can prevent SMS from satisfying the requirement of a critical application, even if SMS is enabled for other uses.

15.2 Registration, use, and recovery are different stages

Enabling a method does not mean all users have already registered it. Registering does not mean it will be required on every sign-in. And a method accepted for MFA may not be accepted for SSPR . Exam questions frequently explore these operational differences.

radio_button_uncheckedshort_text 16. Microsoft Entra security defaults

Security defaults provide a ready-made baseline for tenants that need essential protection without designing complex policies. They require MFA registration, protect administrators and privileged activities, request MFA when necessary, and block legacy authentication protocols. The configuration is essentially on or off, with little granularity.

Organizations with exception, group, application, risk, or location requirements normally use Conditional Access with adequate licensing. When migrating, the policies must replace the baseline protections; simply disabling security defaults without equivalent controls reduces the security posture.

Relevant update

The official documentation consulted in July 2026 includes blocking the device code flow in security defaults for new tenants. As cloud services evolve, always confirm the current behavior in Microsoft Learn before a real deployment.

radio_button_uncheckedshort_text 17. Self-Service Password Reset - SSPR

SSPR allows users to change or reset their own password and, in some scenarios, unlock the account without help desk intervention. The solution reduces calls, downtime, and operational cost. To be secure, it relies on prior registration of methods, a minimum number of proofs, and appropriate policies.

17.1 Change, reset, and unlock

Changing a password normally happens when the user knows the current password. Reset is used when the password was forgotten or needs to be replaced after alternative proof. Unlock releases a locked account according to configuration. Although the interface may combine the experiences, the events have different meanings and policies.

17.2 Methods and number of verifications

The administrator defines the accepted methods and how many are required to reset. Requiring two methods increases assurance, but requires users to register enough options. The operational recommendation is to offer redundancy to prevent the loss of a phone from blocking all recovery.

17.3 Password writeback in a hybrid environment

When configured and licensed, password writeback sends the change or reset performed in the cloud back to the on-premises Active Directory. The new password must obey local policies. This offers a single experience for hybrid users and keeps the password consistent across environments.

radio_button_uncheckedshort_text 18. Password protection and management

18.1 Global banned password list

Microsoft Entra Password Protection uses a global list maintained by Microsoft to block weak, common, or compromised passwords and their variants. The evaluation considers predictable substitutions and patterns, so swapping a letter for a number does not always bypass the protection.

18.2 Custom list

The organization can add its own terms, such as company name, products, locations, or slogans that should not appear in passwords. The goal is not to create a list of all possibilities, but to block words that are very likely in the corporate context.

18.3 Protection in on-premises Active Directory

Microsoft Entra Password Protection agents can extend the global and custom list to AD DS domain controllers. This helps apply a consistent policy across hybrid identities. The deployment requires on-premises components and high-availability planning.

18.4 Smart lockout

Smart lockout helps prevent guessing and brute force. The service tries to differentiate patterns of legitimate users from attackers, locking suspicious attempts without producing unnecessary downtime. It can also protect hybrid environments by filtering attacks before they reach AD DS, when properly configured.

18.5 Leaked passwords and risk

Password protection prevents weak choices at the moment of creation or change, while identity protection services can detect leaked credentials and user risk. These are complementary controls. A previously accepted password can become dangerous after exposure and require remediation.

radio_button_uncheckedshort_text 19. Common attacks and corresponding controls

Architecture reasoning

No method eliminates all risks. Choose layers: strong method, policy, device protection, secure recovery, monitoring, and lifecycle. The best method loses value if the recovery channel is weak.

radio_button_uncheckedshort_text 20. Integrated practical scenario

Contoso has administrative staff, shop-floor operators, temporary contractors, and cloud administrators. The company wants to reduce phishing and password calls without blocking work. One possible strategy is to organize people and resources by risk.

1. All users register security information. Security defaults can be used as an initial baseline, or Conditional Access when the company needs granular policies.
2. Administrators use FIDO2 keys or Windows Hello for Business and a phishing-resistant authentication strength for privileged portals.
3. Employees with corporate laptops use Windows Hello for Business, with a local PIN or biometrics and SSO for applications.
4. Operators at shared stations use portable FIDO2 keys; OATH hardware tokens remain as an alternative where needed.
5. Microsoft Authenticator with number matching is used by mobile users during the transition to passkeys.
6. SMS remains only for low-risk groups or temporary recovery, never as the only option for administrators.
7. TAP is issued on the first day so new users can register passwordless methods; the credential expires quickly.
8. SSPR requires sufficient methods and password writeback integrates users synchronized to the on-premises AD DS.
9. The custom list blocks company name and products; smart lockout and logs help detect password spray.
10. Reports and logs are reviewed to remove old methods and identify users still dependent on passwords.

How to answer the question

First identify the objective: MFA , passwordless , recovery, or password protection. Then observe the user profile and the threat. Finally, select the method and policy that satisfy the requirement with the lowest risk and acceptable friction.

radio_button_uncheckedshort_text 21. SC-900 review

21.1 Frequent conceptual pitfalls

• The Windows Hello for Business PIN is not a domain password sent to the server; it unlocks a key on the device.
• Biometrics are normally not stored in Microsoft Entra ID; they unlock the local credential.
• Two steps do not guarantee two factors if both belong to the same category.
• OTP reduces reuse, but can be captured by real-time phishing.
• MFA does not mean the user will be challenged on every sign-in.
• Passwordless does not mean the absence of verification; possession and a local gesture can provide two factors.
• Enabling a method, registering it, and requiring it are different actions.
• SSPR handles recovery; Password Protection handles the quality of new passwords; smart lockout handles attempts.
• Security defaults is a simple baseline; Conditional Access offers granularity.
• A method can work for MFA and not work for primary authentication or SSPR .

One-sentence summary

Microsoft Entra strengthens sign-in by combining methods, policies, recovery, and password protection; the modern goal is to reduce dependence on reusable secrets and require phishing-resistant credentials for the highest-risk resources.

radio_button_uncheckedshort_text 22. Conclusion

Secure authentication evolved from a simple password comparison to a system of graduated assurances. Independent factors raise trust, policies decide when to require more proof, and cryptographic methods eliminate the reusable password from the flow. Microsoft Authenticator, OATH, hardware tokens, Windows Hello for Business, FIDO2 , and passkeys offer different experiences for different profiles and risks.

SSPR and TAP show that security does not end at the sign-in screen. Users need to register methods, recover accounts, and start using strong credentials without depending on fragile processes. Password Protection and smart lockout reduce predictable passwords and automated attacks, while security defaults provides an initial base for tenants that do not yet have advanced policies.

My assessment is that the most important concept in this chapter is the difference between “more steps” and “more assurance”. An additional code may improve the defense, but a credential bound to the device and the legitimate domain fundamentally changes the game against phishing. For the SC-900, mastering names and purposes is necessary; for professional practice, the goal should be to build an authentication journey that is strong, recoverable, auditable, and simple enough to be truly adopted.

Next step in the track

After understanding how an identity proves who it is, the next chapter studies how Microsoft Entra decides whether it can access a resource: Conditional Access, RBAC, roles, scopes, and least privilege.

radio_button_uncheckedshort_text 23. Review questions

1. Which option correctly represents multifactor authentication?

• A) Password and secret question.
• B) Password and memorized PIN.
• C) Password and FIDO2 security key.
• D) Two codes sent by SMS to the same phone.

Answer explained

Correct answer: C. The password is a knowledge factor and the FIDO2 key represents possession of an authenticator with cryptographic proof. The other options combine evidence from the same category or the same channel.

2. Which statement best describes Windows Hello for Business?

• A) It sends the fingerprint to Microsoft Entra ID for comparison.
• B) It replaces the password with a key tied to the device, unlocked by PIN or biometrics.
• C) It is an OATH token that generates temporary codes.
• D) It is a password reset policy.

Answer explained

Correct answer: B. Windows Hello for Business uses key-based authentication. PIN and biometrics are local gestures that unlock the private key protected on the device.

3. An organization wants to let users reset their own password and synchronize the new password with the on-premises Active Directory. Which features are directly related?

• A) Security defaults and FIDO2 .
• B) SSPR and password writeback .
• C) Smart lockout and number matching .
• D) OATH TOTP and Conditional Access.

Answer explained

Correct answer: B. SSPR allows self-service reset; password writeback sends the change back to AD DS when the integration is configured and licensed.

4. Which feature is most appropriate to prevent SMS from satisfying the requirement of a critical application, requiring only phishing-resistant methods?

• A) Custom banned password list.
• B) Smart lockout .
• C) Authentication strength in a Conditional Access policy.
• D) Per-user MFA in legacy mode.

Answer explained

Correct answer: C. Authentication strengths allow defining which method combinations satisfy the grant control, including a phishing-resistant strength.

radio_button_uncheckedshort_text Essential glossary

radio_button_uncheckedshort_text Official references and update notes

The content was prepared based on the provided study plan and official Microsoft documentation consulted on July 23, 2026. Cloud features, names, and requirements can change; use the pages below for validation before a deployment.

• Microsoft Learn - Study guide for Exam SC-900
• Microsoft Learn - Describe the authentication capabilities of Microsoft Entra ID
• Microsoft Learn - Microsoft Entra authentication overview
• Microsoft Learn - How Microsoft Entra multifactor authentication works
• Microsoft Learn - Microsoft Entra authentication documentation
• Microsoft Learn - Microsoft Authenticator authentication method
• Microsoft Learn - Passwordless authentication options (Windows Hello for Business)
• Microsoft Learn - Temporary Access Pass
• Microsoft Learn - Microsoft Entra security defaults
• Microsoft Learn - Self-service password reset
• Microsoft Learn - Microsoft Entra Password Protection
• Microsoft Learn - Smart lockout
• Microsoft Learn - Authentication strengths

Official sources consulted on July 23, 2026. As cloud services evolve continuously, licensing details, regional availability, menu names, and preview features should be confirmed in the current documentation before a real implementation.