Authentication: Passwords, MFA & Beyond

Authentication vs authorisation

Authentication methods in Microsoft 365

Authentication methods ranked by security

Feature	Security Level	User Experience	Common Use
Password only	🔴 Low (easily phished)	Familiar but risky	Legacy — being phased out
Password + MFA	🟡 Good (blocks most attacks)	Extra step but manageable	Current standard for most orgs
Microsoft Authenticator	🟢 Strong (push notification)	Tap to approve on phone	Recommended MFA method
FIDO2 security key	🟢 Very strong (phishing-resistant)	Physical key, tap to sign in	High-security roles
Windows Hello for Business	🟢 Very strong (biometric/PIN)	Face, fingerprint, or PIN	Corporate-managed Windows devices
Certificate-based auth	🟢 Strong (smart cards)	Insert card + PIN	Government, regulated industries
Passkeys	🟢 Very strong (phishing-resistant)	Biometric or device unlock	The future — replacing passwords

Key exam concept: Passwords alone are NOT secure. The exam always favours MFA or passwordless methods. If a question asks “what should the admin enable to improve security?” — the answer almost always involves MFA or a stronger method.

Multi-Factor Authentication (MFA)

MFA requires two or more factors from different categories:

Factor	Category	Example
Something you know	Knowledge	Password, PIN
Something you have	Possession	Phone (Authenticator app), security key
Something you are	Biometric	Fingerprint, face recognition

MFA works because even if an attacker steals your password (something you know), they still need your phone (something you have) to complete sign-in.

💡 Scenario: Brew & Byte enables MFA

Brew & Byte has 30 employees and never used MFA. After a phishing email nearly compromised Kai’s account, they decide to enable it:

1. Microsoft Entra admin center → Protection → Multifactor authentication
2. Enable Security defaults (free, enables MFA for all users automatically)
3. All users register Microsoft Authenticator on their phones
4. Sign-in now requires: password + Authenticator approval

Result: Even when Zoe (the designer) clicks a phishing link and enters her password on a fake site, the attacker can’t complete sign-in because they don’t have Zoe’s phone.

Cost: $0 — Security defaults are free and included in every M365 plan.

Passwordless authentication — the future

Microsoft is moving towards passwordless authentication:

• Microsoft Authenticator (passwordless mode) — tap to approve, no password needed
• FIDO2 security keys — physical USB/NFC key, phishing-resistant
• Windows Hello for Business — face, fingerprint, or PIN tied to the device
• Passkeys — cross-platform, phishing-resistant, biometric-based

ℹ️ Why passwordless is more secure

Passwords are the weakest link because:

• Users reuse them across sites
• They can be phished (fake login pages)
• They can be brute-forced or sprayed
• They can be leaked in data breaches

Passwordless methods eliminate passwords entirely. A FIDO2 key or Windows Hello credential is tied to a specific device, can’t be phished (it verifies the website’s identity too), and can’t be reused on other sites.

Exam tip: If a question asks about “phishing-resistant authentication” → the answer is FIDO2 security keys, Windows Hello for Business, or passkeys. NOT Authenticator app (which is strong but not phishing-resistant by default).

Self-Service Password Reset (SSPR)

SSPR lets users reset their own passwords without calling the helpdesk:

• Configured in Microsoft Entra admin center → Protection → Password reset
• Users register recovery methods (phone, email, security questions)
• Reduces helpdesk calls by 20-40% in most organisations

Exam note: SSPR is about convenience AND security. It reduces the risk of helpdesk-based social engineering attacks (attacker calls helpdesk pretending to be the user).

🎬 Video walkthrough

Flashcards

Question

What's the difference between authentication and authorisation?

Click or press Enter to reveal answer

Answer

Authentication (AuthN) = verifying WHO you are (password, MFA, biometric). Authorisation (AuthZ) = determining WHAT you can access (roles, groups, policies, licenses).

Click to flip back

Show hint

Question

What are the three factors used in multi-factor authentication?

Click or press Enter to reveal answer

Answer

1) Something you know (password, PIN). 2) Something you have (phone, security key). 3) Something you are (fingerprint, face). MFA requires two or more from different categories.

Click to flip back

Question

What makes FIDO2 security keys phishing-resistant?

Click or press Enter to reveal answer

Answer

FIDO2 keys verify the website's identity as part of authentication — if the site is fake (phishing), the key won't work. The credential is also tied to the specific device and can't be exported or reused.

Click to flip back

Show hint

Knowledge Check

Knowledge Check

Clearfield Council requires phishing-resistant authentication for all councillors accessing sensitive systems. Which method should Director Chen deploy?

APassword + SMS verification codeBPassword + Microsoft Authenticator push notificationCFIDO2 security keys (passwordless)DPassword complexity requirements (minimum 16 characters)

Check Answer

Knowledge Check

An employee's password is compromised in a data breach. They also use Microsoft Authenticator for MFA. Can the attacker sign in to their M365 account?

AYes — once they have the password, MFA is automatically bypassedBNo — they still need the employee's phone to approve the Authenticator promptCYes — Authenticator only protects the first sign-in, not subsequent onesDNo — the compromised password is automatically changed by M365

Check Answer

---

Next up: Microsoft Defender XDR — the threat protection and intelligence platform that watches for attacks across your entire M365 environment.