This chapter covers Azure authentication methods — the different ways identity can be verified. AZ-900 tests this under objective 2.5, building on the previous chapter's introduction to identity and access.
Jump to a section
A simple way to picture Azure Authentication Methods
Think about the different ways a bank might verify your identity — a password for online banking, a physical key or card for a safety deposit box, or a fingerprint scan at a branch. Each is a different method of authentication, verifying identity in a different way, and a bank might require more than one at once for higher-security actions. Azure authentication methods work the same way: there are several different ways to verify a user's identity, and combining more than one (multi-factor authentication) provides stronger security than relying on just one method alone.
What authentication is
Authentication is the process of verifying that a user (or application) is who they claim to be, typically before granting access to a resource. This is distinct from authorization, which determines what an already-verified identity is allowed to do — authentication answers "who are you," while authorization answers "what can you do."
Common authentication methods
Passwords: the most traditional method, though used alone it's generally considered less secure than combining it with additional factors.
Multi-factor authentication (MFA): requiring more than one verification method — something you know (a password), something you have (a phone or security key), or something you are (a fingerprint or other biometric) — significantly increasing security over a password alone.
Passwordless authentication: methods that verify identity without a traditional password at all, such as a biometric scan or a physical security key.
Why multiple methods matter
Relying on a single authentication method, especially a password alone, leaves an account more vulnerable if that one credential is compromised. Combining multiple, different types of factors makes it significantly harder for an unauthorized party to gain access, even if one factor (like a password) is compromised.
Azure's role
Microsoft Entra ID (covered in the previous chapter) supports multiple authentication methods, including multi-factor and passwordless options, letting organizations configure the level of authentication security appropriate for their needs.
Start with a base authentication method
Most commonly, a username and password serve as the initial identity claim, though this alone is generally considered a weaker security posture.
Add a second factor for stronger security
Multi-factor authentication adds an additional verification step — such as a code from a phone app or a physical security key — significantly increasing security over a password alone.
Consider passwordless options where appropriate
For even stronger or more convenient security, passwordless methods (biometrics, security keys) can replace traditional passwords entirely for some scenarios.
Apply consistently across the organization
Organizations typically configure authentication requirements consistently, sometimes combined with policies like Conditional Access (covered in the next chapter) to apply stronger requirements in specific situations.
An organization requires multi-factor authentication for all employees signing into company resources, so that even if an employee's password is compromised through a phishing attempt, an attacker still can't gain access without the second factor (like a code from the employee's phone).
A separate organization adopts passwordless authentication for certain high-security roles, using security keys or biometrics instead of passwords entirely, reducing the risk of password-related attacks like phishing or credential reuse for those specific accounts.
Objective 2.5 expects candidates to understand authentication as distinct from authorization, and to recognize multi-factor authentication as a stronger security practice than a single factor alone.
A common wrong answer is confusing authentication with authorization — authentication verifies identity; authorization determines what that identity can access, covered more directly in the RBAC chapter. Another common trap is assuming a strong password alone provides sufficiently strong security — multi-factor authentication is considered significantly stronger than a password by itself.
Stable terms: authentication, multi-factor authentication (MFA), passwordless authentication. The distinction between authentication (who you are) and authorization (what you can do) is one of the most fundamentally tested concepts in this objective.
Memory trick: authentication = proving who you are. Authorization = what you're allowed to do once you've proven it. MFA combines multiple proof methods for stronger security than any single one alone.
Authentication is the process of verifying a user's identity, distinct from authorization, which determines what they're allowed to do.
Multi-factor authentication combines multiple verification methods, significantly increasing security over a single factor alone.
Passwordless authentication methods (biometrics, security keys) can replace traditional passwords for stronger or more convenient security.
Microsoft Entra ID supports multiple authentication methods, letting organizations configure the security level appropriate for their needs.
These come up on the exam all the time. Here's how to tell them apart.
Authentication
Verifies who a user or application is
Happens first, typically during sign-in
Answers: 'Who are you?'
Authorization
Determines what a verified identity can access
Happens after authentication succeeds
Answers: 'What are you allowed to do?'
Mistake
Authentication and authorization mean the same thing.
Correct
Authentication verifies who a user is; authorization determines what that verified user is allowed to do. They're related but distinct steps in accessing a resource.
Mistake
A strong password alone provides sufficient security.
Correct
Multi-factor authentication, combining a password with an additional factor, is considered significantly more secure than relying on a password alone, since a single compromised credential doesn't grant access on its own.
Mistake
Passwordless authentication is less secure because there's no password.
Correct
Passwordless methods (biometrics, security keys) can actually be more secure than passwords, since they avoid risks like password reuse or phishing that specifically target traditional passwords.
Authentication verifies who a user or application is, typically through a sign-in process. Authorization determines what that verified identity is then permitted to do. Authentication happens first; authorization follows once identity is confirmed.
It's an authentication method requiring more than one type of verification — such as a password plus a code from a phone app — significantly increasing security compared to relying on a single factor alone, since an attacker would need to compromise multiple factors, not just one.
Yes — passwordless methods like biometrics or physical security keys can be more secure than traditional passwords, since they avoid risks specific to passwords, like reuse across sites or susceptibility to phishing attacks.
You've just covered Azure Authentication Methods — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?