Biometric authentication overview (preview)

[This article is prerelease documentation and is subject to change.]

Important

You're responsible for configuring and using this Biometric authentication and enrollment functionality in compliance with applicable law, including but not limited to biometric and privacy laws (for example, BIPA and the GDPR), including: (i) providing notice to data subjects, including with respect to retention periods and destruction; (ii) obtaining legally sufficient consent from data subjects; and (iii) processing and deleting the biometric data and biometric identifiers. Biometric data and biometric identifiers will have the meanings set forth in applicable biometric and privacy laws and include equivalent terms set forth in any applicable law. You will defend and indemnify Microsoft against any claims made by a third party related to this biometric functionality, including but not limited to the adequacy of consent.

Biometric authentication is a voice-security service that verifies a customer's identity from their voice during a natural conversation. Alongside knowledge-based questions, PINs, passwords, or one-time passcodes, biometric authentication combines voice biometrics, synthetic-speech detection, and anti-spoofing signals to confirm that callers are who they claim to be. Because verification happens passively as the customer speaks, biometric authentication reduces friction for the customer and shortens the identity checks that customer service representatives (CSRs) perform on every call.

This article explains what Biometric authentication is, why organizations use it, how it verifies identity, and the ways it fits into a voice interaction. It's intended for administrators and decision-makers who are evaluating voice authentication for Contact Center Intelligence.

Important

  • This is a preview feature.
  • Preview features aren’t meant for production use and might have restricted functionality. These features are subject to supplemental terms of use, and are available before an official release so that customers can get early access and provide feedback.

How Biometric authentication works

Biometric authentication verifies identity by comparing a caller's live speech to a stored voiceprint — a secure mathematical representation of the customer's voice, stored within your Dataverse environment. The service follows a three-step model: consent, enrollment, and authentication.

Before a customer's voice can be used for authentication, the customer grants permission for biometric authentication to create and store a voiceprint within your Dataverse environment. Consent is captured explicitly, and enrollment proceeds only after the customer agrees. You must obtain legally sufficient consent from the customer for voiceprint enrolment.

Enrollment

After consent is granted, biometric authentication collects your customer's speech to build a voiceprint. The service converts that speech into a secure mathematical representation and associates it with a customer identifier and stores it within your Dataverse environment. The voiceprint — not the raw audio — is what biometric authentication uses for later comparisons.

Authentication

On future calls, biometric authentication compares the caller's live speech against the stored voiceprint stored within your Dataverse environment. During this comparison, the service evaluates two kinds of signals:

  • Speaker similarity — how closely the live voice matches the enrolled voiceprint.
  • Anti-spoofing signals — whether the audio shows evidence of synthetic speech, recorded playback, or other non-natural patterns.

Biometric authentication combines these signals into an authentication decision.

Interaction types

Biometric authentication applies across two interaction types, which differ in how the customer's speech is collected:

  • Human-to-Bot (H2B) — Authentication happens while the customer interacts with a voice agent. As the voice agent collects the customer's speech, biometric authentication uses the same audio to enroll or authenticate. If the customer doesn't provide enough speech, the voice agent can ask more questions to gather it, and biometric authentication returns the result to the agent.
  • Human-to-Human (H2H) — Authentication happens passively during a natural conversation between the customer and a customer service representative (CSR).

The same underlying voiceprint, speaker-similarity, and anti-spoofing concepts apply to both interaction types. Only the experience that gathers the speech differs, not the biometric evaluation itself.

Authentication outcomes

After authentication runs, Biometric authentication returns an outcome that determines how the interaction proceeds. Plan your voice agent flows and representative guidance around these outcomes:

  • Grant access when the caller is confidently authenticated, so the customer can be securely serviced.
  • Trigger step-up authentication when the result is inconclusive, so the customer is prompted for an additional authentication method before proceeding.
  • Route for manual review when the interaction needs a person to verify the caller.

Related content

  • Last updated on