Implement Authentication and Access Management · Topic 1 of 6
Authentication Methods, MFA and SSPR
SC-300 authentication: the methods policy, Authenticator, passkeys, certificate based authentication, Temporary Access Pass, strengths, MFA settings and SSPR.
- 6 min
- The Authentication methods policy targets methods at groups. Setting Migration Complete retires the legacy MFA and SSPR settings.
- TAP defaults to one hour and ranges from 10 minutes to 30 days.
- Built in strengths are MFA, Passwordless MFA and Phishing resistant MFA.
What it is
Microsoft Entra ID supports many ways to prove who a user is. As an administrator you decide which methods are allowed, for whom, and when they must be used. The aim is strong sign in that is still easy for users, with passwordless and phishing resistant methods preferred over passwords and codes sent by text.
This page covers the methods, how to manage them, tenant wide multifactor authentication settings, and self service password reset.
How it works
The authentication methods policy
The Authentication methods policy is the single place to enable each method and choose the users or groups it applies to. A tenant that still uses the older multifactor authentication and self service password reset settings can move to it by setting the migration status to Migration Complete, after which the policy is the one that targets methods at specific groups and the legacy settings are ignored.
| Method | Notes |
|---|---|
| Microsoft Authenticator | Push notification with number matching, one time codes, or passwordless sign in |
| Passkeys (FIDO2) | Hardware security keys or passkeys, the strongest and phishing resistant |
| Windows Hello for Business | Biometrics or PIN bound to a device |
| Certificate based authentication (CBA) | Users sign in with an X.509 certificate, for example a smart card, without a password |
| Temporary Access Pass (TAP) | A time limited code for bootstrapping, used to register passwordless methods |
| OATH hardware or software tokens | A changing code, which works with no network connection |
| SMS and voice call | Convenient but weaker |
| Email one time passcode and security questions | Usable for password reset and guests only, not as an MFA method |
Temporary Access Pass
A Temporary Access Pass is a time limited passcode that lets a user sign in strongly without a password. It is used to onboard new hires, to register a passkey or the Authenticator app, and to recover when a user loses every method. The default lifetime is one hour, and you can set from 10 minutes up to 30 days. It can be one time use or usable several times during its lifetime, and administrators with the right role create it for a user.
Authentication strengths
An authentication strength is a Conditional Access control that states exactly which combinations of methods satisfy a sign in. There are built in strengths: Multifactor authentication, Passwordless MFA and Phishing resistant MFA, and you can create custom ones. Use a stronger strength for sensitive applications and administrators, for example requiring phishing resistant MFA, which means a FIDO2 key, Windows Hello for Business or certificate based authentication.
Tenant wide MFA settings
- Number matching in the Authenticator app shows a number on the sign in screen that the user types into the app, which blocks accidental or forced approvals, called push fatigue attacks. It is on by default.
- Additional context shows the application name and location in the notification.
- Registration campaigns nudge users to set up the Authenticator app, or a stronger method, at sign in, a chosen number of times.
- Security defaults is a free set of baseline protections, and Conditional Access gives full control with Entra ID P1.
- Per user MFA is the older approach, and Conditional Access is recommended instead.
Self service password reset (SSPR)
SSPR lets users reset or unlock their own password.
| Setting | Options |
|---|---|
| Enabled for | None, Selected group or All |
| Number of methods required | One or two |
| Methods available | Authenticator app, OATH token, SMS, voice call, email, security questions, depending on policy |
| Registration | Require users to register when they sign in, and re confirm every set number of days |
| Writeback | Password writeback sends a new password back to on premises Active Directory |
Security questions and email can be used for SSPR but never as an MFA method. For synchronised users to self remediate a password change, they must be in the SSPR scope, and password writeback must be enabled.
Keeping accounts safe when something goes wrong
You can disable an account and revoke user sessions to end a compromise quickly. Revoking invalidates refresh tokens so the user must sign in again.
Choosing the right method
| The situation | Method |
|---|---|
| New hire with no credentials yet | Temporary Access Pass |
| Staff at remote sites with no mobile signal | OATH hardware token |
| Highest protection against phishing | FIDO2 passkey or security key |
| Smart card users on a regulated network | Certificate based authentication |
| Most staff with smartphones | Microsoft Authenticator, with number matching |
| Move from legacy MFA and SSPR settings | Authentication methods policy, Migration Complete |
A worked scenario
A bank wants administrators to use only phishing resistant sign in. It enables FIDO2 passkeys and certificate based authentication in the authentication methods policy for the Administrators group, and creates a Conditional Access policy that requires the Phishing resistant MFA strength. New administrators are onboarded with a Temporary Access Pass, which lets them register their key on the first day. For the wider staff, it keeps Authenticator with number matching and runs a registration campaign. The tenant had used the legacy MFA settings, so it sets the migration status to Migration Complete.
What to remember for the exam
- The Authentication methods policy targets methods at groups. Setting Migration Complete retires the legacy MFA and SSPR settings.
- TAP defaults to one hour and ranges from 10 minutes to 30 days.
- Built in strengths are MFA, Passwordless MFA and Phishing resistant MFA.
- Number matching blocks push fatigue attacks. Security questions and email are SSPR only.
- Writeback and SSPR scope are needed for synchronised users to reset passwords.
"Phishing resistant" means FIDO2 or passkeys, Windows Hello for Business, or certificate based authentication, not SMS or push.
How the exam asks about this
- "A single policy that targets methods at specific groups." The Authentication methods policy, with migration Complete.
- "Onboard a new hire who has no credentials." A Temporary Access Pass.
- "A method that works with no network at a remote site." An OATH hardware token.
- "Which method can be used for SSPR but not as a second factor?" Security questions.
Common mistakes
Editing the legacy MFA page after migration. The Authentication methods policy now controls methods.
Counting SMS as phishing resistant. It is not.
Using a TAP as a permanent credential. It is time limited, for bootstrapping.
Forgetting writeback. Synced users cannot complete a reset to on premises without it.
Check yourself
What is the default lifetime of a Temporary Access Pass?
One hour, adjustable from 10 minutes to 30 days.
Which built in authentication strength requires FIDO2, Windows Hello for Business or certificates?
Phishing resistant MFA.
What does number matching protect against?
Push fatigue attacks, where a user accidentally approves a notification.
Topic 1 of 6 in Implement Authentication and Access Management
Test yourself on Implement Authentication and Access Management
The full Microsoft SC-300 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.