Authentication Methods: Plan & Implement

Planning your authentication strategy

The authentication methods landscape

Method	Strength	Use Case
Password	Weakest (standalone)	Legacy default — always pair with MFA
SMS / Voice call	Low	Backup only — vulnerable to SIM swap
Microsoft Authenticator	Strong	Push notifications with number matching
FIDO2 security keys	Very strong	Passwordless, phishing-resistant
Certificate-based auth (CBA)	Very strong	Government, regulated industries
Temporary Access Pass (TAP)	Time-limited	Onboarding, device setup, recovery
Windows Hello for Business	Very strong	Passwordless on Windows devices
OAuth 2.0 tokens	Varies	App-to-app, API access

Authentication methods policy

The Authentication methods policy in Entra replaces the legacy per-user MFA settings. Key concepts:

• Enable per method — turn individual methods on/off for all users or specific groups
• Registration campaigns — nudge users to set up Authenticator (we’ll cover this in the MFA module)
• Migration guide — Entra provides a migration status showing whether you’ve fully moved from legacy MFA settings to the new policy

💡 Exam tip: legacy MFA vs authentication methods policy

The exam tests whether you know the difference between two places where MFA methods are configured:

• Legacy: per-user MFA settings (the old portal at aka.ms/mfasetup) — methods enabled globally for all users
• Modern: Authentication methods policy (Entra admin center → Protection → Authentication methods) — granular, group-targeted, supports passwordless

Microsoft is migrating everyone to the modern policy. The legacy settings will be deprecated. If an exam question asks about enabling a method “for a specific group of users,” the answer is the Authentication methods policy.

Certificate-based authentication (CBA)

Certificate-based authentication lets users sign in using an X.509 certificate on a smart card or device — no password needed.

How it works:

1. Admin uploads trusted CA certificates to Entra ID
2. Configure CBA authentication rules (which certificate fields map to which user attributes)
3. User presents their certificate (smart card, device certificate, or virtual smart card)
4. Entra validates the certificate chain, checks revocation (CRL/OCSP), and maps the certificate to a user account

Key configuration decisions:

Setting	Options	Notes
Username binding	PrincipalName, RFC822Name, Subject, SHA1PublicKey	Maps certificate field → Entra user attribute
Authentication strength	Single-factor or multi-factor	Multi-factor CBA counts as phishing-resistant MFA
Revocation checking	CRL, OCSP	OCSP is checked first if configured
Affinity binding	Required or low	Whether certificate must match at the issuer or exact certificate level

ℹ️ Scenario: Anika plans CBA for a government client

Anika’s government client issues PIV (Personal Identity Verification) smart cards to all employees. Federal policy requires phishing-resistant MFA for all cloud access.

Her plan:

1. Upload the government CA chain (root + intermediate CAs) to Entra ID
2. Configure username binding: PrincipalName → userPrincipalName in Entra
3. Set authentication strength to multi-factor (smart card + PIN counts as two factors)
4. Enable CRL distribution point checking for revocation
5. Create a Conditional Access policy requiring “phishing-resistant MFA” — CBA satisfies this

Result: Users insert smart card, enter PIN, and they’re in. No passwords, no phone-based MFA. Meets federal compliance requirements.

Temporary Access Pass (TAP)

A Temporary Access Pass is a time-limited passcode issued by an admin. It’s designed for scenarios where users can’t use their normal authentication methods.

Common scenarios:

• Onboarding — new employee needs to sign in before they’ve set up Authenticator or FIDO2
• Lost device — user lost their phone with Authenticator, needs to sign in to register a new device
• FIDO2 recovery — user’s security key broke, needs temporary access while a replacement arrives
• Windows Hello for Business setup — some WHfB deployment models require TAP for initial provisioning

TAP settings:

Setting	Default	Range
Minimum lifetime	1 hour	10 minutes – 30 days
Maximum lifetime	24 hours	10 minutes – 30 days
Default lifetime	1 hour	Within min/max range
One-time use	No	Yes / No

ℹ️ Scenario: Jake onboards a new designer at Coastline

New designer Sofia starts Monday. Jake needs her to sign in, set up MFA, and register her MacBook — but she can’t set up Authenticator until she signs in for the first time.

Jake’s approach:

1. Creates a TAP for Sofia in the Entra admin center (Users → Sofia → Authentication methods → Add)
2. Sets lifetime to 2 hours, one-time use enabled
3. Sends Sofia the TAP via a secure channel (encrypted email or in-person)
4. Sofia signs in with her UPN + TAP code
5. During sign-in, she’s prompted to register Authenticator (TAP satisfies MFA for registration)
6. The TAP expires after use — from now on, Sofia uses Authenticator

Key insight: TAP can satisfy the MFA requirement for registering other methods. This solves the “chicken-and-egg” problem of needing MFA to register MFA.

OAuth 2.0 tokens

OAuth 2.0 is the protocol behind how apps get authorised access to resources without seeing the user’s password. You won’t configure OAuth from scratch — Entra handles it — but you need to understand token types:

Token	Purpose	Lifetime
Access token	Presented to a resource (API) to prove authorisation	Default 60–90 min (configurable)
Refresh token	Exchanged for a new access token when the current one expires	Default 90 days (rolling)
ID token	Contains claims about the user’s identity (used by the app)	Matches access token lifetime
Primary Refresh Token (PRT)	Device-level token for SSO across all apps on a joined device	Tied to device registration

Token lifetime policies are largely deprecated. You cannot customise refresh token or session token lifetimes via token lifetime policies (deprecated January 2021). Access token lifetimes can still be adjusted (10 min to 1 day), but the exam-expected approach is Conditional Access session controls.

💡 Exam tip: use CA session controls, not token lifetime policies

Token lifetime policies for refresh and session tokens are deprecated. For controlling session behaviour, use Conditional Access session controls instead:

• Sign-in frequency — how often users must re-authenticate (e.g., every 8 hours)
• Persistent browser session — whether the session survives browser close

Access and ID token lifetimes can still be configured (10 min to 1 day, default ~1 hour), but these are edge cases. The exam answer is almost always CA session controls.

Microsoft Authenticator

The Authenticator app is the centrepiece of Microsoft’s modern MFA strategy.

Modes:

• Push notification — user approves/denies on their phone (with number matching)
• Passwordless phone sign-in — no password entered; user matches number and uses biometric/PIN
• TOTP codes — 6-digit time-based codes (works offline)

Number matching (enabled by default): When a user gets a push notification, the sign-in screen shows a two-digit number. The user must type that number in the Authenticator app. This prevents MFA fatigue attacks (where attackers spam push notifications hoping the user taps “Approve”).

Additional context (enabled by default): The push notification shows the app name and approximate location (city) of the sign-in attempt. Helps users identify suspicious requests.

ℹ️ Scenario: Jake sets up Authenticator for Coastline Creative

Coastline Creative has been using SMS for MFA. Jake wants to upgrade everyone to Authenticator.

His plan:

1. Enable Microsoft Authenticator in the Authentication methods policy
2. Configure: push notifications ON, number matching ON, additional context ON
3. Use a registration campaign (nudge) to prompt users to set up Authenticator at next sign-in
4. Give the team 30 days to switch — most will do it after the first nudge
5. After 30 days, disable SMS as an MFA method

Why the switch matters: SMS is vulnerable to SIM swapping. One of Coastline’s freelancers had their number hijacked last year. Authenticator with number matching is phishing-resistant and doesn’t rely on carrier security.

🎬 Video walkthrough

Flashcards

Question

What is a Temporary Access Pass (TAP) and when would you issue one?

Click or press Enter to reveal answer

Answer

A time-limited passcode issued by an admin for scenarios like onboarding (user hasn't set up MFA yet), lost devices, or FIDO2 key replacement. TAP can satisfy MFA requirements, solving the chicken-and-egg problem of needing MFA to register MFA. It can be one-time or multi-use, with a configurable lifetime.

Click to flip back

Question

What is the difference between single-factor and multi-factor certificate-based authentication?

Click or press Enter to reveal answer

Answer

Single-factor CBA: the certificate alone counts as one factor — user still needs another factor for MFA. Multi-factor CBA: the certificate + PIN together count as two factors (possession + knowledge), satisfying MFA requirements. Multi-factor CBA is considered phishing-resistant.

Click to flip back

Question

What is number matching in Microsoft Authenticator?

Click or press Enter to reveal answer

Answer

When a push notification is triggered, the sign-in screen shows a two-digit number. The user must type this number into the Authenticator app to approve. This prevents MFA fatigue attacks where attackers spam approval requests. Number matching is enabled by default.

Click to flip back

Question

Why can you no longer use token lifetime policies to control refresh token lifetimes?

Click or press Enter to reveal answer

Answer

Microsoft deprecated refresh token and session token lifetime configuration via token lifetime policies in January 2021. To control session duration, use Conditional Access session controls: sign-in frequency (how often users re-authenticate) and persistent browser session (whether sessions survive browser close).

Click to flip back

Knowledge Check

Knowledge Check

A new employee needs to sign in and register for MFA, but they can't set up MFA without first signing in. How should the admin resolve this?

AIssue a Temporary Access Pass (TAP) that satisfies the MFA requirement during registrationBTemporarily disable MFA for the user, let them register, then re-enable itCAsk the user to call the helpdesk each time they need to sign in until MFA is configuredDCreate a Conditional Access policy that excludes new users from MFA

Check Answer

Knowledge Check

A government agency requires phishing-resistant MFA for all cloud access. Employees have PIV smart cards. Which authentication method should the identity admin configure?

AMicrosoft Authenticator with number matchingBSMS-based MFA with a registered government phone numberCCertificate-based authentication configured as multi-factorDTOTP codes from a hardware token

Check Answer

Knowledge Check

Jake wants to move Coastline Creative from SMS-based MFA to Microsoft Authenticator. He needs most users to switch within 30 days without forcing an immediate cutover. What should he configure?

ADisable SMS immediately and wait for users to call the helpdeskBSend an email asking everyone to download the appCCreate a Conditional Access policy blocking SMS-based MFADEnable Authenticator in the authentication methods policy and configure a registration campaign

Check Answer

---

Next up: Passwordless & Windows Hello for Business — eliminate passwords entirely with FIDO2 passkeys, Windows Hello, and Entra Kerberos for hybrid environments.