Authentication, MFA and Password Protection

What it is

Microsoft Entra ID offers several ways to prove who you are. A password alone is weak, because passwords are guessed, stolen and reused, so Entra adds a second proof with multifactor authentication (MFA), offers passwordless methods, and protects passwords that are still used.

How it works

Authentication methods

Multifactor authentication

MFA asks for two or more kinds of proof, taken from different categories.

Because an attacker rarely has more than one of these, MFA blocks most account takeover attacks even when a password is stolen. A password plus a second password is not MFA, because both are the same kind of factor.

Entra offers ways to turn MFA on. Security defaults is a free set of basic protections that requires MFA for administrators and, when needed, for users. Conditional Access policies give finer control and need Entra ID P1.

Passwordless authentication

Passwordless methods replace the password with something stronger: the Authenticator app, Windows Hello for Business or a FIDO2 key. They are easier for users and harder to phish, because there is no shared secret to type into a fake site.

Password protection and management

• Banned password lists. Entra ID blocks a global list of weak and commonly used passwords. Organisations can add a custom list of their own words, such as company or product names.
• Smart lockout. After too many failed attempts, sign in is locked, and Entra can tell the real user from an attacker's guesses.
• On premises password protection. The same banned lists can be applied to Active Directory passwords.
• Self service password reset (SSPR). Users reset or unlock their own accounts after proving identity, which reduces help desk calls. With password writeback the new password also reaches the on premises directory.

A worked scenario

A company's staff keep being phished. The company turns on MFA with the Authenticator app, so a stolen password is no longer enough. It adds a custom banned password list with its own brand names and enables smart lockout to slow guessing. For staff at remote sites with no mobile signal, it issues OATH hardware tokens, which generate codes without a connection. Finally it enables self service password reset so locked out users fix their own accounts.

What happens during an MFA sign in

1. The user enters the account name and password.
2. Entra ID checks them, and sees that MFA is required.
3. The user is asked for a second factor, for example approving a notification in the Microsoft Authenticator app.
4. With number matching, the screen shows a number and the user must type it into the app, which blocks accidental or forced approvals, known as push fatigue attacks.
5. If the second factor is correct, a token is issued and the user is signed in.

Registering for MFA and password reset

Users register their methods once, in a single combined registration process that covers both multifactor authentication and self service password reset. If a user loses a phone, an administrator can issue a Temporary Access Pass, a time limited code that lets the user sign in and register a new method.

Choosing a method for a situation

Banned passwords at work

If a user tries to choose Contoso2026! and Contoso is on the custom banned list, Entra ID rejects it, even though it looks complex. Rejecting passwords that attackers try first is much more useful than only requiring symbols.