Describe the capabilities of Microsoft Entra
Microsoft Entra Authentication
CoreUnderstand authentication methods, MFA, passwordless choices, and password protection.
Aligned to the SC-900 skills measured as of July 28, 2026; product behavior verified September 10, 2026.
Why this matters
Authentication strength depends on the evidence used to verify an identity and on controls that reduce weak or compromised credential risk.
Must Know
- Microsoft Entra authentication methods include passwords and stronger methods such as passkeys, Microsoft Authenticator, hardware security keys, certificates, and temporary access credentials, depending on supported scenarios.
- Multifactor authentication requires evidence from two or more different factor categories: something known, possessed, or inherent.
- Passwordless authentication verifies identity without requiring a traditional password at sign-in and can reduce password-related attack exposure.
- Microsoft Entra Password Protection detects and blocks known weak passwords and organization-specific banned terms.
- Self-service password reset lets eligible users reset or unlock credentials after completing required verification.
Compare and Distinguish
- MFA vs two-step use of one factor: two passwords are still one knowledge factor; MFA combines different factor categories.
- MFA vs passwordless: MFA describes the number and diversity of factors; passwordless describes omission of the traditional password.
- Password protection vs password reset: blocking weak password choices versus recovering or changing a credential.
- Authentication method vs Conditional Access: a method proves identity; Conditional Access decides which access requirements to impose.
Scenario examples
- A user signs in with a password and then confirms a prompt on a registered device, satisfying two factor categories.
- An organization blocks passwords containing its brand name by adding custom banned terms.
- An employee uses a passkey instead of entering a password.
Exam traps
- Two knowledge secrets do not create true multifactor authentication.
- MFA does not determine what resources an authenticated user is authorized to access.
- Passwordless does not mean authentication-free.
- Self-service password reset is not the same capability as a banned-password list.
Key takeaways
- Choose methods based on how identity proof is established.
- MFA combines different factor categories.
- Passwordless removes the traditional password from the sign-in experience.
- Password protection and reset solve different credential problems.
Ready for the quiz?
- Why are two passwords not MFA?
- How does passwordless differ from no authentication?
- Which capability blocks organization-specific weak terms?
Related objectives
- D2.2.S1 — Describe the authentication methods
- D2.2.S2 — Describe multifactor authentication (MFA)
- D2.2.S3 — Describe password protection and management capabilities