Different authentication methods of Azure AD
In this, we will learn and understand the various authentication methods of Azure AD.
Multifactor authentication requires more than one form of verification, such as a trusted device or a fingerprint scan, to prove that an identity is legitimate. It means that, even when an identity’s password has been compromised, a hacker can’t access a resource. However, Multifactor authentication dramatically improves the security of identity, while still being simple for users. The extra authentication factor must be something that’s difficult for an attacker to obtain or duplicate.
Further, as part of the sign-in experience for accounts in Azure Active Directory (Azure AD), there are different ways that a user can authenticate themselves. A username and password is the most common way a user would historically provide credentials. With modern authentication and security features in Azure AD, that basic password should be supplemented or replaced with more secure authentication methods.
Authentication method strength and security
When you deploy features like Azure AD Multi-Factor Authentication in your organization, review the available authentication methods. Choose the methods that meet or exceed your requirements in terms of security, usability, and availability. Where possible, use authentication methods with the highest level of security.
The following table outlines the security considerations for the available authentication methods. Availability is an indication of the user being able to use the authentication method, not of the service availability in Azure AD:
Further, Azure Active Directory multifactor authentication works by requiring:
- Firstly, something you know – typically a password or PIN and
- Secondly, something you have – such as a trusted device that’s not easily duplicated, like a phone or hardware key or
- Lastly, something you are – biometrics like a fingerprint or face scan.
The following extra forms of verification can be used with Azure Active Directory multi-factor authentication:
- Firstly, the Microsoft Authenticator app
- Secondly, SMS
- Thirdly, Voice call
- Then, the OATH Hardware token
- Lastly, the Microsoft authenticator app
Security defaults and multifactor authentication
Security defaults are a set of basic identity security mechanisms recommended by Microsoft. When enabled, these recommendations will be automatically enforced in your organization. The goal is to ensure that all organizations have a basic level of security-enabled at no extra cost. These defaults enable some of the most common security features and controls, including:
- Firstly, enforcing Azure Active Directory multifactor authentication registration for all users.
- Secondly, forcing administrators to use multifactor authentication.
- Lastly, requiring all users to complete multifactor authentication when needed.
Reference: Microsoft Documentation, Doc 2