3.2.1. Authentication Methods
💡 First Principle: Microsoft Entra ID supports a range of authentication methods that trade off convenience, cost, and phishing-resistance differently, and picking the right one for a scenario matters because a method chosen only for convenience can quietly reintroduce the weaknesses passwords were supposed to leave behind.
| Method | Description | Phishing-Resistant? |
|---|---|---|
| Microsoft Authenticator | Push notification or passwordless sign-in via the mobile app | Yes (passwordless mode) |
| FIDO2 security key | Physical hardware key using public-key cryptography | Yes |
| Windows Hello for Business | Biometric or PIN tied to a specific device | Yes |
| OATH hardware/software tokens | Time-based one-time passcodes | Partial |
| SMS / voice call | Code sent via text or phone call | No — legacy, being de-emphasized |
Passwordless authentication is the direction Microsoft is pushing the ecosystem toward: methods like FIDO2 keys and Windows Hello for Business remove the password from the sign-in flow entirely, eliminating the risk of a phished or reused password altogether, rather than just adding a second check on top of one.
⚠️ Exam Trap: MFA is not limited to a text message code — the table above lists five distinct method categories, and SMS/voice call is actually the weakest of them. Don't assume "has MFA enabled" automatically means "phishing-resistant."
Reflection Question: Why is a FIDO2 security key considered phishing-resistant in a way that an SMS code is not?
