3.2.1. Authentication Methods
💡 First Principle: Microsoft Entra ID supports a range of authentication methods that trade off convenience, cost, and phishing-resistance differently, and picking the right one for a scenario matters because a method chosen only for convenience can quietly reintroduce the weaknesses passwords were supposed to leave behind.
| Method | Description | Phishing-Resistant? |
|---|---|---|
| Microsoft Authenticator (push or phone sign-in) | Approve a sign-in notification, or sign in without a password, from the mobile app | No — an approval can still be phished |
| Passkey in Microsoft Authenticator | A device-bound passkey stored in the Authenticator app | Yes |
| FIDO2 security key | Physical hardware key using public-key cryptography | Yes |
| Windows Hello for Business | Biometric or PIN tied to a specific device | Yes |
| Certificate-based authentication | An X.509 certificate, for example on a smart card | Yes |
| OATH hardware/software tokens | Time-based one-time passcodes | No — a code can be relayed to an attacker |
| SMS / voice call | Code sent via text or phone call | No — legacy, being de-emphasized |
Passwordless authentication is the direction Microsoft is pushing the ecosystem toward: methods like FIDO2 keys and Windows Hello for Business remove the password from the sign-in flow entirely, eliminating the risk of a phished or reused password altogether, rather than just adding a second check on top of one.
⚠️ Exam Trap: MFA is not limited to a text message code — the table above lists several distinct methods, and SMS/voice call is actually the weakest of them. Being passwordless isn't the same as being phishing-resistant either: signing in with an Authenticator notification is passwordless, but only a passkey in Authenticator is phishing-resistant. Don't assume "has MFA enabled" automatically means "phishing-resistant."
Reflection Question: Why is a FIDO2 security key considered phishing-resistant in a way that an SMS code is not?
