{"items":[{"href":"./","toc_title":"Authentication Documentation"},{"children":[{"href":"overview-authentication","toc_title":"What is authentication?"}],"toc_title":"Overview"},{"children":[{"href":"tutorial-enable-azure-mfa","toc_title":"Enable Microsoft Entra multifactor authentication"},{"href":"tutorial-risk-based-sspr-mfa","toc_title":"Enable risk-based sign-in protection"},{"href":"tutorial-enable-sspr","toc_title":"Enable self-service password reset"},{"href":"tutorial-enable-cloud-sync-sspr-writeback","toc_title":"Enable cloud sync password writeback"},{"href":"tutorial-enable-sspr-writeback","toc_title":"Enable password writeback to on-premises"},{"href":"tutorial-password-policy-overview-frequently-asked-questions","toc_title":"Password policy overview and frequently asked questions"},{"href":"tutorial-configure-custom-password-protection","toc_title":"Configure custom banned password lists"},{"href":"tutorial-enable-security-notifications-for-audit-logs","toc_title":"Enable security notifications"}],"expanded":true,"toc_title":"Tutorials"},{"children":[{"children":[{"href":"concept-authentication-methods-manage","toc_title":"Authentication methods policy migration"},{"href":"howto-authentication-temporary-access-pass","toc_title":"Temporary Access Pass"},{"href":"concept-authentication-passkeys-fido2","toc_title":"Passkeys (FIDO2)"},{"href":"concept-authentication-windows-hello","toc_title":"Windows Hello for Business"},{"href":"concept-authentication-authenticator-app","toc_title":"Microsoft Authenticator"},{"href":"concept-certificate-based-authentication","toc_title":"Certificates"},{"href":"concept-authentication-platform-credential-for-macos","toc_title":"Platform Credential for macOS"},{"href":"concept-authentication-oath-tokens","toc_title":"OATH tokens"},{"href":"concept-authentication-phone-options","toc_title":"Voice call"},{"href":"concept-authentication-qr-code","toc_title":"QR code"},{"href":"howto-authentication-sms-signin","toc_title":"SMS"},{"href":"howto-authentication-use-email-signin","toc_title":"Email"},{"href":"concept-authentication-security-questions","toc_title":"Security questions"},{"href":"how-to-plan-password-scramble-phishing-resistant-passwordless-authentication","toc_title":"Remove passwords from Microsoft Entra ID"}],"toc_title":"Authentication methods"},{"children":[{"href":"concept-phone-providers","toc_title":"Telephony providers overview"},{"href":"phone-providers-faq","toc_title":"Telephony providers FAQ"}],"toc_title":"Telephony providers"},{"children":[{"href":"concept-authentication-strengths","toc_title":"Overview"},{"href":"concept-authentication-strength-how-it-works","toc_title":"How authentication strength works"},{"href":"concept-authentication-strengths","toc_title":"Built-in authentication strengths"},{"href":"concept-authentication-strength-advanced-options","toc_title":"Custom authentication strengths"},{"href":"concept-authentication-strength-external-users","toc_title":"External users"},{"href":"troubleshoot-authentication-strengths","toc_title":"Troubleshoot"}],"toc_title":"Conditional Access authentication strength"},{"children":[{"href":"concept-account-recovery-overview","toc_title":"Account recovery overview"},{"href":"self-service-account-recovery","toc_title":"Account recovery FAQ"},{"href":"concept-authentication-verified-id","toc_title":"Verified ID identity verification"}],"toc_title":"Account recovery"},{"children":[{"href":"concept-mfa-howitworks","toc_title":"How MFA works"},{"href":"concept-authentication-default-enablement","toc_title":"Default protection"},{"href":"concept-system-preferred-authentication","toc_title":"System-preferred authentication"},{"href":"concept-mandatory-multifactor-authentication","toc_title":"Mandatory MFA"},{"href":"concept-authentication-external-method-provider","toc_title":"External MFA provider"},{"href":"concepts-azure-multi-factor-authentication-prompts-session-lifetime","toc_title":"Prompts and session lifetime"},{"href":"concept-mfa-telephony-fraud","toc_title":"Understanding telephony fraud"},{"href":"concept-mfa-regional-opt-in","toc_title":"Regional opt-in"},{"href":"concept-mfa-data-residency","toc_title":"Data residency"},{"href":"concept-mfa-licensing","toc_title":"Licenses"},{"href":"/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication","toc_title":"MFA for Office 365"},{"href":"multi-factor-authentication-faq","toc_title":"FAQ"}],"toc_title":"Multifactor authentication"},{"children":[{"href":"kerberos","toc_title":"Introduction to Microsoft Entra Kerberos"},{"href":"configure-microsoft-entra-kerberos-trust","toc_title":"Configure Microsoft Entra Kerberos trust"},{"href":"kerberos-faq","toc_title":"FAQ"}],"toc_title":"Microsoft Entra Kerberos"},{"children":[{"href":"concept-sspr-howitworks","toc_title":"How password reset works"},{"href":"concept-sspr-writeback","toc_title":"On-premises integration"},{"href":"concept-sspr-policy","toc_title":"Policies"},{"href":"concept-sspr-licensing","toc_title":"Licenses"},{"href":"concept-sspr-deploy","toc_title":"Deployment guide"}],"toc_title":"Self-service password reset"},{"children":[{"href":"concept-password-ban-bad-combined-policy","toc_title":"Combined password policy check"},{"href":"concept-password-ban-bad","toc_title":"Eliminate weak passwords in the cloud"},{"href":"concept-password-ban-bad-on-premises","toc_title":"Eliminate weak passwords on-premises"}],"toc_title":"Password protection"},{"href":"concept-registration-mfa-sspr-combined","toc_title":"Security information registration"},{"href":"concept-resilient-controls","toc_title":"Resilient access controls"},{"href":"concept-authentication-web-browser-cookies","toc_title":"Web browser cookies"}],"expanded":true,"toc_title":"Concepts"},{"children":[{"href":"how-to-authentication-methods-manage","toc_title":"Manage authentication methods"},{"href":"howto-authentication-temporary-access-pass","toc_title":"Temporary Access Pass"},{"children":[{"children":[{"href":"how-to-plan-prerequisites-phishing-resistant-passwordless-authentication","toc_title":"Get started"},{"href":"how-to-deploy-phishing-resistant-passwordless-authentication","toc_title":"Plan and deploy"},{"href":"how-to-plan-persona-phishing-resistant-passwordless-authentication","toc_title":"Persona guidance"},{"href":"how-to-plan-rdp-phishing-resistant-passwordless-authentication","toc_title":"RDP guidance"}],"toc_title":"Plan phishing-resistant passwordless authentication"},{"children":[{"displayName":"passkey,federated,identity provider,android,ios,macOS,third-party","href":"concept-passkey-browser-authentication-federated-identity-provider","toc_title":"Passkey browser authentication for federated identity providers"},{"href":"how-to-authentication-passkeys-fido2","toc_title":"Enable passkeys (FIDO2)"},{"href":"how-to-authentication-entra-passkeys-on-windows","toc_title":"Enable Entra passkey on Windows"},{"href":"how-to-register-entra-passkey-windows","toc_title":"Register Entra passkey on Windows"},{"href":"how-to-sign-in-entra-passkey-windows","toc_title":"Sign in with Entra passkey on Windows"},{"href":"how-to-synced-passkeys","toc_title":"Enable synced passkey"},{"href":"how-to-register-passkey","toc_title":"Register passkey"},{"href":"how-to-sign-in-passkey","toc_title":"Sign in with passkey"},{"href":"passkey-faq","toc_title":"Passkey FAQ"},{"href":"concept-fido2-compatibility","toc_title":"Passkey (FIDO2) compatibility matrix"},{"href":"concept-fido2-hardware-vendor","toc_title":"Become a passkey (FIDO2) vendor"}],"toc_title":"Passkey (FIDO2) authentication"},{"children":[{"href":"how-to-enable-authenticator-passkey","toc_title":"Enable passkeys in Authenticator"},{"href":"how-to-register-passkey-authenticator","toc_title":"Register passkeys in Authenticator"},{"href":"how-to-sign-in-passkey-authenticator","toc_title":"Sign in with passkeys in Authenticator"},{"href":"passkey-authenticator-faq","toc_title":"Passkeys in Authenticator FAQ"},{"href":"howto-authentication-passwordless-phone","toc_title":"Enable Authenticator authentication method"},{"href":"how-to-mfa-number-match","toc_title":"How number matching works"},{"href":"how-to-mfa-additional-context","toc_title":"Use additional context"},{"href":"how-to-mfa-authenticator-lite","toc_title":"Use Authenticator Lite"},{"href":"how-to-transfer-authenticator-new-phone","toc_title":"Transfer Authenticator to a new phone"}],"toc_title":"Microsoft Authenticator"},{"children":[{"href":"how-to-register-passkey-with-security-key","toc_title":"Register passkey with a security key"},{"href":"howto-authentication-passwordless-security-key-windows","toc_title":"Enable security key sign-in to Windows"},{"href":"how-to-security-key-sign-in","toc_title":"Sign in with a security key"},{"href":"howto-authentication-passwordless-security-key-on-premises","toc_title":"SSO to on-premises resources"},{"href":"howto-authentication-passwordless-faqs","toc_title":"Hybrid FAQs"},{"href":"howto-authentication-passwordless-troubleshoot","toc_title":"Troubleshoot hybrid"}],"toc_title":"Hybrid"},{"children":[{"href":"concept-certificate-based-authentication","toc_title":"What is Microsoft Entra CBA?"},{"href":"concept-certificate-based-authentication-technical-deep-dive","toc_title":"How Microsoft Entra CBA works"},{"href":"how-to-certificate-based-authentication","toc_title":"Configure Microsoft Entra CBA"},{"href":"how-to-configure-certificate-authorities","toc_title":"Configure certificate authorities"},{"href":"concept-certificate-based-authentication-certificate-revocation-list","toc_title":"Certificate revocation list"},{"href":"concept-certificate-based-authentication-smartcard","toc_title":"Windows smart card sign-in"},{"href":"concept-certificate-based-authentication-mobile-ios","toc_title":"Apple devices"},{"href":"concept-certificate-based-authentication-mobile-android","toc_title":"Android devices"},{"href":"concept-certificate-based-authentication-certificateuserids","toc_title":"Certificate user IDs"},{"href":"concept-certificate-based-authentication-migration","toc_title":"Migrate federated users"},{"href":"certificate-based-authentication-faq","toc_title":"FAQ"},{"children":[{"href":"certificate-based-authentication-federation-get-started","toc_title":"Configure CBA with federation"},{"href":"certificate-based-authentication-federation-android","toc_title":"Use on Android Devices"},{"href":"certificate-based-authentication-federation-ios","toc_title":"Use on iOS Devices"}],"toc_title":"Federated CBA with Microsoft Entra ID"}],"toc_title":"Certificate-based authentication"}],"toc_title":"Phishing-resistant MFA"},{"children":[{"href":"how-to-account-recovery-enable","toc_title":"Admin guide"},{"href":"how-to-account-recovery-cost-savings-estimator","toc_title":"Cost savings estimator"},{"href":"how-to-account-recovery-for-users","toc_title":"User guide"}],"toc_title":"Account recovery"},{"children":[{"href":"howto-mfa-getstarted","toc_title":"Deployment guide"},{"href":"howto-mfa-mfasettings","toc_title":"Configure settings"},{"href":"howto-mfa-userdevicesettings","toc_title":"Configure users"},{"href":"how-to-mandatory-multifactor-authentication","toc_title":"Verify mandatory MFA"},{"href":"how-to-unlock-users-for-mandatory-multifactor-authentication","toc_title":"Unlock users for mandatory MFA"},{"href":"how-to-mfa-expected-inbound-assertions","toc_title":"Federate MFA setup"},{"href":"how-to-authentication-find-coverage-gaps","toc_title":"Find coverage gaps"},{"href":"howto-mfa-userstates","toc_title":"Enable per-user MFA"},{"href":"how-to-mfa-manage-oath-tokens","toc_title":"Manage hardware OATH tokens"},{"href":"how-to-mfa-upload-oath-tokens","toc_title":"Upload hardware OATH tokens"},{"href":"how-to-authentication-external-method-manage","toc_title":"Manage external authentication method"},{"href":"concept-mfa-authprovider","toc_title":"Configure authentication providers"},{"href":"howto-mfa-app-passwords","toc_title":"Use app passwords"},{"children":[{"href":"/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa","toc_title":"AD FS Adapter"},{"href":"multi-factor-authentication-get-started-adfs","toc_title":"Federation Services"},{"href":"howto-mfa-adfs","toc_title":"Use AD FS"}],"toc_title":"Directory Federation"},{"children":[{"href":"howto-mfa-nps-extension","toc_title":"Use existing network policy servers"},{"href":"howto-mfa-nps-extension-advanced","toc_title":"Advanced configuration for NPS extension"},{"href":"/azure/vpn-gateway/vpn-gateway-radius-mfa-nsp","toc_title":"Azure VPN and Microsoft Entra multifactor authentication"},{"href":"howto-mfa-nps-extension-rdg","toc_title":"Remote Desktop Gateway"},{"href":"howto-mfa-nps-extension-vpn","toc_title":"VPN"}],"toc_title":"RADIUS Integration"}],"toc_title":"Microsoft Entra multifactor authentication"},{"href":"how-to-authentication-qr-code","toc_title":"Enable QR code auth method"},{"children":[{"href":"howto-authentication-sms-signin","toc_title":"Manage"},{"children":[{"href":"concept-sms-voice-retirement-faq","toc_title":"SMS/Voice retirement FAQ"}],"href":"concept-sms-voice-retirement","toc_title":"Passkey by default and SMS/Voice retirement"},{"href":"how-to-authentication-sms-supported-apps","toc_title":"Supported apps for SMS-based authentication"},{"href":"how-to-authentication-two-way-sms-unsupported","toc_title":"Two-way SMS unsupported"}],"toc_title":"Use SMS-based authentication"},{"href":"howto-authentication-use-email-signin","toc_title":"Use email address sign-in"},{"href":"concept-authentication-default-enablement","toc_title":"Use Microsoft managed settings"},{"children":[{"href":"howto-registration-mfa-sspr-combined","toc_title":"Combined MFA and SSPR registration"},{"href":"howto-registration-mfa-sspr-combined-troubleshoot","toc_title":"Troubleshoot combined registration"},{"href":"how-to-mfa-registration-campaign","toc_title":"Run a registration campaign"}],"toc_title":"Security info registration"},{"children":[{"href":"howto-sspr-customization","toc_title":"User customization options"},{"href":"howto-sspr-authenticationdata","toc_title":"Preregister authentication data"},{"href":"howto-sspr-windows","toc_title":"SSPR for Windows clients"}],"toc_title":"Self-service password reset"},{"children":[{"href":"howto-password-ban-bad-on-premises-deploy","toc_title":"Plan and deploy"},{"href":"howto-password-ban-bad-on-premises-operations","toc_title":"Enable and configure"},{"href":"howto-password-ban-bad-on-premises-monitor","toc_title":"Monitor"},{"href":"howto-password-ban-bad-on-premises-troubleshoot","toc_title":"Troubleshoot"},{"href":"howto-password-ban-bad-on-premises-faq","toc_title":"FAQs"},{"href":"howto-password-ban-bad-on-premises-agent-versions","toc_title":"Agent version history"}],"toc_title":"On-premises password protection"},{"href":"howto-password-smart-lockout","toc_title":"Microsoft Entra smart lockout"},{"children":[{"href":"how-to-authentication-track-linkable-identifiers","toc_title":"Linkable identifiers"},{"href":"howto-authentication-methods-activity","toc_title":"Authentication methods activity"},{"href":"howto-sspr-reporting","toc_title":"SSPR Reports"},{"href":"howto-mfa-reporting","toc_title":"MFA Reports"},{"href":"howto-mfa-reporting-datacollection","toc_title":"Data collection"}],"toc_title":"Reporting"},{"children":[{"children":[{"href":"how-to-migrate-mfa-server-to-azure-mfa","toc_title":"Overview"},{"href":"how-to-migrate-mfa-server-to-mfa-user-authentication","toc_title":"Migrate to Azure MFA and user authentication"},{"href":"how-to-migrate-mfa-server-to-mfa-with-federation","toc_title":"Migrate to Azure MFA with Federation"},{"href":"how-to-mfa-server-migration-utility","toc_title":"Migration Utility"}],"toc_title":"Migrate MFA Server to Microsoft Entra multifactor authentication"}],"toc_title":"MFA Server"},{"children":[{"href":"troubleshoot-voice-call-sms","toc_title":"Voice call and SMS authentication"},{"href":"troubleshoot-sspr","toc_title":"Self-service password reset (SSPR)"},{"href":"troubleshoot-sspr-writeback","toc_title":"SSPR writeback"},{"href":"passwords-faq","toc_title":"SSPR FAQ"},{"href":"multi-factor-authentication-faq","toc_title":"MFA FAQ"}],"toc_title":"Troubleshoot"}],"toc_title":"How-to guides"},{"children":[{"displayName":"Accessibility, Special People, MFA Accessibility","href":"accessibility/authentication-methods-accessibility","toc_title":"Accessibility"},{"href":"https://support.microsoft.com/account-billing/how-to-use-the-microsoft-authenticator-app-9783c865-0308-42fb-a519-8cf666fe0acc","toc_title":"MFA user guide"},{"href":"/samples/browse/?products=azure","toc_title":"Code samples"},{"href":"/powershell/azure/","toc_title":"Azure PowerShell cmdlets"},{"href":"/graph/api/resources/authenticationmethods-overview","toc_title":"Authentication methods APIs - Microsoft Graph"},{"href":"/graph/api/resources/authenticationstrengths-overview","toc_title":"Authentication strengths APIs - Microsoft Graph"},{"href":"/graph/api/resources/authenticationmethodspolicies-overview","toc_title":"Authentication methods policy APIs - Microsoft Graph"},{"href":"/graph/api/resources/authenticationmethods-usage-insights-overview","toc_title":"Authentication methods activity APIs - Microsoft Graph"},{"href":"../users/directory-service-limits-restrictions","toc_title":"Service limits and restrictions"}],"toc_title":"Reference"},{"children":[{"href":"https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789","toc_title":"Azure feedback forum"},{"href":"/answers/topics/azure-active-directory.html","toc_title":"Microsoft Q\u0026A question page"},{"href":"https://www.microsoft.com/security/business/microsoft-entra-pricing","toc_title":"Pricing"},{"href":"feature-availability","toc_title":"Feature availability"},{"href":"../../fundamentals/whats-new","toc_title":"Service updates"},{"href":"https://stackoverflow.com/questions/tagged/azure-active-directory","toc_title":"Stack Overflow"},{"href":"phishing-resistant-authentication-videos","toc_title":"Videos"}],"toc_title":"Resources"}],"metadata":{"author":"justinha","brand":"entra","breadcrumb_path":"/entra/breadcrumb/toc.json","count_of_node_with_href":182,"extendBreadcrumb":false,"feedback_github_repo":"MicrosoftDocs/entra-docs","feedback_product_url":"https://feedback.azure.com/d365community/forum/79b1327d-d925-ec11-b6e6-000d3a4f06a4","feedback_system":"Standard","manager":"dougeby","ms.author":"justinha","ms.service":"entra-id","ms.subservice":"authentication","open_to_public_contributors":true,"searchScope":["Microsoft Entra"],"titleSuffix":"Microsoft Entra ID","uhfHeaderId":"MSDocsHeader-Entra"}}