Microsoft Entra Verified ID

Microsoft Entra Verified ID is a managed service within Microsoft Entra that allows organizations to issue and verify verifiable credentials (VCs) based on open standards from the World Wide Web Consortium (W3C) and the Decentralized Identity Foundation (DIF). It enables a trust model where issuers (e.g., employers, universities) digitally sign claims about a subject, holders store these claims in a digital wallet, and verifiers can cryptographically verify the claims without contacting the issuer each time. This eliminates the need for a central identity provider to broker every verification.

Traditional identity systems rely on a central authority (e.g., Microsoft Entra ID) to authenticate users and issue tokens. This creates a single point of failure, privacy concerns (the central authority can track all authentications), and limited interoperability. Decentralized identity shifts control to the user (holder) using DIDs and VCs. DIDs are globally unique identifiers that are cryptographically verifiable and do not require a central registry. VCs are tamper-evident credentials that contain claims and are signed by the issuer's DID.

Microsoft Entra Verified ID uses the did:ion method. ION is a decentralized, layer 2 network that runs on top of the Bitcoin blockchain. DIDs are created by generating a key pair and anchoring the DID document to ION. The DID document contains:

DID operations (create, update, deactivate) are submitted as batches to ION, which uses Sidetree protocol. The DID document is immutable once anchored; updates require creating a new version and deactivating the old one.

To set up Entra Verified ID in your tenant:

You can automate issuance and verification using Microsoft Graph. For example, to issue a VC via Graph:

POST https://graph.microsoft.com/beta/identity/verifiableCredentials/issuance
Content-Type: application/json

{
  "credentials": [
    {
      "type": "VerifiedEmployee",
      "claims": {
        "displayName": "John Doe",
        "jobTitle": "Administrator"
      }
    }
  ],
  "subject": {
    "id": "user@contoso.com"
  }
}

To verify a VP, use:

POST https://graph.microsoft.com/beta/identity/verifiableCredentials/presentations

PowerShell cmdlets are available via the Microsoft.Graph module. For example:

Connect-MgGraph -Scopes "VerifiableCredential.Issuance.All"
New-MgIdentityVerifiableCredentialIssuance -CredentialType "VerifiedEmployee" -SubjectId "user@contoso.com"

Issuers can revoke VCs by updating their DID document with a revocation list endpoint. The verifier checks this endpoint during verification. Revocation is not immediate; it depends on how often the verifier fetches the list. The issuer can set a credentialStatus property in the VC that points to a RevocationList2021 or StatusList2021 entry.

Entra Verified ID is compatible with other W3C-compliant wallets and issuers. However, Microsoft Authenticator is the primary wallet for Microsoft’s ecosystem. Verifiers can be any application that can resolve DIDs and verify signatures.

Microsoft Entra Verified ID provides a standards-based, decentralized identity solution that reduces reliance on central identity providers. It enables secure, privacy-preserving verification of claims using DIDs and VCs. Configuration involves setting up the service, defining credential contracts, and integrating with Microsoft Graph. The exam focuses on the architecture, flow, and components rather than deep cryptographic details.