Cyber Intelligence
Implement Authentication and Access Management · 25-30% of exam

L5. Authentication Methods: Passwordless, MFA and FIDO2

Video generating

Check back soon for the video lesson on Authentication Methods: Passwordless, MFA and FIDO2

Configure authentication methods for the SC-300 exam: understand the Microsoft Authenticator app, FIDO2 security keys, Windows Hello for Business, SMS/phone verification, and the authentication methods policy that governs which methods are available to your users.

Authentication Methods Policy

The authentication methods policy in Entra ID controls which methods are available for MFA and self-service password reset (SSPR). This is the centralized location where you enable or disable methods and target them to specific user groups.

Navigate to: Entra admin center > Protection > Authentication methods > Policies

Available Authentication Methods

MethodPasswordlessPhishing-ResistantMFA-Capable
Microsoft Authenticator (push)YesNoYes
Microsoft Authenticator (passkey)YesYesYes
FIDO2 Security KeyYesYesYes
Windows Hello for BusinessYesYesYes
SMSNoNoYes (second factor)
Voice callNoNoYes (second factor)
Email OTPNoNoYes (second factor)
OATH hardware/software tokensNoNoYes (second factor)
Exam tip: The SC-300 exam frequently asks which methods are phishing-resistant. Only three qualify: FIDO2 security keys, Windows Hello for Business, and Microsoft Authenticator with passkey (device-bound). Push notifications and SMS are NOT phishing-resistant.

FIDO2 Security Keys

FIDO2 keys are external hardware devices (USB, NFC, or Bluetooth) that provide phishing-resistant, passwordless authentication. Configuration steps:

  1. Enable FIDO2 in the authentication methods policy
  2. Optionally restrict to specific key AAGUIDs (manufacturer allowlist)
  3. Users register their keys at https://mysignins.microsoft.com
Exam tip: FIDO2 keys work for both Entra ID cloud sign-in and on-premises Active Directory sign-in (when hybrid with Entra Connect and running Server 2019+ DCs). Know this distinction for cross-environment scenarios.

Windows Hello for Business

Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices. It uses biometrics (face, fingerprint) or a PIN bound to the device. The credential never leaves the device: Entra ID validates a signed assertion, not the biometric data.

Deployment models:

  • Cloud-only: No on-premises infrastructure needed
  • Hybrid key trust: Uses keys synced via Entra Connect
  • Hybrid certificate trust: Uses PKI certificates from on-prem CA

Microsoft Authenticator

The Authenticator app supports multiple modes:

  • Push notification: User taps Approve/Deny (not phishing-resistant)
  • Number matching: Required by default since May 2023: the sign-in screen shows a number the user must type in the app
  • Passkey: Device-bound credential (phishing-resistant, passwordless)
Exam tip: Number matching is mandatory for Authenticator push notifications. Questions about "approving a number shown on screen" refer to this feature. It reduces MFA fatigue attacks where users accidentally approve malicious sign-in prompts.

Registration Campaigns

You can configure registration campaigns to prompt users to set up specific authentication methods. This is useful when migrating users from SMS-based MFA to the Authenticator app. Registration campaigns are configured in the authentication methods policy and can target specific groups.

Combined Registration

Entra ID uses a combined registration experience where users register for both MFA and SSPR in a single flow at https://aka.ms/setupsecurityinfo. This must be enabled for modern authentication method management to work properly.

Exam Focus Points
  • Only three methods are phishing-resistant: FIDO2 keys, Windows Hello for Business, and Authenticator passkeys
  • Number matching is mandatory for Authenticator push notifications to prevent MFA fatigue attacks
  • FIDO2 security keys work for both cloud and on-premises sign-in (with hybrid and Server 2019+ DCs)
  • Authentication methods policy is the centralized location to enable/disable methods and target them to user groups
  • Combined registration lets users register for MFA and SSPR in a single flow at aka.ms/setupsecurityinfo
Knowledge Check

1. Which authentication methods are considered phishing-resistant in Microsoft Entra ID?

2. What is the purpose of number matching in Microsoft Authenticator?

3. Where do users register their security information for both MFA and SSPR in a combined experience?