9.1 Implementing & Managing Authentication Methods

Quick Answer: Entra ID authentication methods range from legacy passwords to phishing-resistant passwordless options like FIDO2 security keys, Microsoft Authenticator, and Windows Hello for Business. You manage them centrally through the Authentication Methods Policy (Entra admin center → Protection → Authentication methods), and users register once for both MFA and SSPR through the combined registration experience.

Microsoft Entra ID (formerly Azure AD) supports several authentication methods that span a strength spectrum from weak legacy credentials to phishing-resistant passwordless sign-in. The MS-102 administrator is expected to know which methods exist, when to use each, how to enable and target them, and how registration works.

The Authentication Method Strength Spectrum

Know the closed set. Microsoft's built-in Phishing-resistant MFA strength in Conditional Access accepts exactly three combinations: FIDO2 security key, Windows Hello for Business (or platform credential), and certificate-based authentication (multifactor). Nothing else qualifies. Authenticator phone sign-in satisfies the Passwordless MFA strength but not the phishing-resistant one — this is the single most common wrong answer on this topic.

---

Passwordless Methods

Microsoft's direction is passwordless authentication. The three primary passwordless methods in Entra ID are:

FIDO2 Security Keys

FIDO2 security keys are the strongest authentication method Entra ID supports. They use asymmetric cryptography (a private key never leaves the device) and are phishing-resistant by design. They are ideal for high-security environments and for users who cannot use a phone (kiosk workers, shared device scenarios). Supported form factors include USB, NFC, and Bluetooth Low Energy (BLE). FIDO2 credentials are tied to the Entra tenant and cannot be reused across tenants.

Microsoft Authenticator (Passwordless Phone Sign-In)

In passwordless mode, the Authenticator app becomes the primary credential. The user enters their username on the sign-in page, then approves a number-matching prompt in the app and completes a biometric or PIN check on the phone. No password is ever entered. This is the easiest passwordless path for most information workers because it requires no special hardware — but note that it is passwordless, not phishing-resistant, so it cannot satisfy a Conditional Access policy that requires the Phishing-resistant MFA strength. (Passkeys stored in Authenticator are a separate, FIDO2-based capability and do qualify.)

Windows Hello for Business

Windows Hello for Business replaces passwords on Windows 10/11 devices with a device-bound credential protected by a biometric (face, fingerprint) or PIN. It can be deployed in key-trusted, certificate-trusted, or cloud-trusted architecture depending on whether you have on-prem AD and PKI. For cloud-only tenants the cloud-trusted (key) deployment is simplest.

---

MFA Methods and the Number Matching Improvement

When passwordless is not enabled, the Authenticator app can still serve as a second factor. Microsoft made number matching mandatory for Authenticator push approvals in May 2023: the sign-in screen displays a number, and the user must type that number into the app before approving. It is enforced for every tenant and cannot be turned off, so there is no toggle to hunt for — if an exam option offers to "enable number matching," the underlying point being tested is what number matching does, not where you switch it on. It defeats push-fatigue attacks where a bad actor spams approval requests hoping the user taps "Approve." Additional context (app name, location, IP) is also shown in the notification, and App Lock can require a biometric or PIN before the approval is accepted.

Passkeys by Default and the SMS / Voice Retirement

Microsoft has published a dated retirement plan for telephony-based authentication. Be precise about what is retiring: it is Microsoft-provided SMS and voice delivery, not the concept of phone-based MFA.

Organisations that genuinely must keep SMS or voice can continue to do so only by configuring a customer-managed telecom provider through the Microsoft Security Store; Microsoft simply stops being the carrier. Everyone else should migrate users to passkeys/FIDO2, Windows Hello for Business, or the Authenticator app well before the February 2027 date.

Because MS-102 itself retires on November 30, 2026, the September 2026 passkey-default milestone is the one most likely to be live while you are still eligible to sit the exam.

---

Managing Methods: The Authentication Methods Policy

The Authentication Methods Policy is the central control plane. In the Entra admin center, navigate to Protection → Authentication methods → Policies. For each method you can:

• Enable the method for all users, selected groups, or no one
• Configure method-specific settings (e.g., Authenticator authentication mode and additional context, restrict FIDO2 key AAGUIDs to an allowlist, enforce key restrictions, Temporary Access Pass lifetime)
• Report on registration via the Registration tab and the authenticationMethods:UserReadAll Microsoft Graph permissions

Migration from Per-User MFA

Microsoft is retiring the legacy per-user MFA (RequireMultiFactorAuthentication) console in favor of the Authentication Methods Policy and Conditional Access. The recommended pattern is:

1. Enable the desired methods in the Authentication Methods Policy (target groups, not All users, during rollout).
2. Create a Conditional Access policy that grants access only when the user satisfies MFA (the "Require multifactor authentication" grant control).
3. Use the registration campaign / conditional access to drive users to register at aka.ms/mfasetup.

Per-user MFA is still functional for tenants without Conditional Access licensing, but new features (number matching, geographic location, FIDO2 key restrictions) are only configurable through the Authentication Methods Policy.

---

Combined Registration (Security Info)

The combined registration experience consolidates SSPR and MFA registration into a single flow at aka.ms/mfasetup (My Security info). Instead of registering twice (once for SSPR, once for MFA), users register their methods once and those methods are available for both scenarios. Combined registration is enabled by default for new tenants.

Administrators can enforce registration through a Conditional Access policy that requires users to register security info within a window of time (e.g., 3 days) before access is blocked. The Registration tab in the Authentication Methods Policy shows which users have registered which methods, which is essential for monitoring rollout completion.