# Azure Authentication Methods > Chapter 27 of the Courseiva AZ-900 curriculum — https://courseiva.com/learn/az-900/azure-authentication **Official objective:** 2.5 — Azure Architecture Services ## Introduction This chapter covers Azure authentication methods — the different ways identity can be verified. AZ-900 tests this under objective 2.5, building on the previous chapter's introduction to identity and access. ## More Than One Way to Prove Who You Are Think about the different ways a bank might verify your identity — a password for online banking, a physical key or card for a safety deposit box, or a fingerprint scan at a branch. Each is a different method of authentication, verifying identity in a different way, and a bank might require more than one at once for higher-security actions. Azure authentication methods work the same way: there are several different ways to verify a user's identity, and combining more than one (multi-factor authentication) provides stronger security than relying on just one method alone. ## Core explanation ### What authentication is Authentication is the process of verifying that a user (or application) is who they claim to be, typically before granting access to a resource. This is distinct from authorization, which determines what an already-verified identity is allowed to do — authentication answers "who are you," while authorization answers "what can you do." ### Common authentication methods - **Passwords**: the most traditional method, though used alone it's generally considered less secure than combining it with additional factors. - **Multi-factor authentication (MFA)**: requiring more than one verification method — something you know (a password), something you have (a phone or security key), or something you are (a fingerprint or other biometric) — significantly increasing security over a password alone. - **Passwordless authentication**: methods that verify identity without a traditional password at all, such as a biometric scan or a physical security key. ### Why multiple methods matter Relying on a single authentication method, especially a password alone, leaves an account more vulnerable if that one credential is compromised. Combining multiple, different types of factors makes it significantly harder for an unauthorized party to gain access, even if one factor (like a password) is compromised. ### Azure's role Microsoft Entra ID (covered in the previous chapter) supports multiple authentication methods, including multi-factor and passwordless options, letting organizations configure the level of authentication security appropriate for their needs. ## Real-world context An organization requires multi-factor authentication for all employees signing into company resources, so that even if an employee's password is compromised through a phishing attempt, an attacker still can't gain access without the second factor (like a code from the employee's phone). A separate organization adopts passwordless authentication for certain high-security roles, using security keys or biometrics instead of passwords entirely, reducing the risk of password-related attacks like phishing or credential reuse for those specific accounts. ## Exam focus Objective 2.5 expects candidates to understand authentication as distinct from authorization, and to recognize multi-factor authentication as a stronger security practice than a single factor alone. A common wrong answer is confusing authentication with authorization — authentication verifies identity; authorization determines what that identity can access, covered more directly in the RBAC chapter. Another common trap is assuming a strong password alone provides sufficiently strong security — multi-factor authentication is considered significantly stronger than a password by itself. Stable terms: **authentication**, **multi-factor authentication (MFA)**, **passwordless authentication**. The distinction between authentication (who you are) and authorization (what you can do) is one of the most fundamentally tested concepts in this objective. Memory trick: authentication = proving who you are. Authorization = what you're allowed to do once you've proven it. MFA combines multiple proof methods for stronger security than any single one alone. ## Step by step 1. **Start with a base authentication method** — Most commonly, a username and password serve as the initial identity claim, though this alone is generally considered a weaker security posture. 2. **Add a second factor for stronger security** — Multi-factor authentication adds an additional verification step — such as a code from a phone app or a physical security key — significantly increasing security over a password alone. 3. **Consider passwordless options where appropriate** — For even stronger or more convenient security, passwordless methods (biometrics, security keys) can replace traditional passwords entirely for some scenarios. 4. **Apply consistently across the organization** — Organizations typically configure authentication requirements consistently, sometimes combined with policies like Conditional Access (covered in the next chapter) to apply stronger requirements in specific situations. ## Comparisons ### Authentication vs Authorization **Authentication:** - Verifies who a user or application is - Happens first, typically during sign-in - Answers: 'Who are you?' **Authorization:** - Determines what a verified identity can access - Happens after authentication succeeds - Answers: 'What are you allowed to do?' ## Common misconceptions - **Misconception:** Authentication and authorization mean the same thing. **Reality:** Authentication verifies who a user is; authorization determines what that verified user is allowed to do. They're related but distinct steps in accessing a resource. - **Misconception:** A strong password alone provides sufficient security. **Reality:** Multi-factor authentication, combining a password with an additional factor, is considered significantly more secure than relying on a password alone, since a single compromised credential doesn't grant access on its own. - **Misconception:** Passwordless authentication is less secure because there's no password. **Reality:** Passwordless methods (biometrics, security keys) can actually be more secure than passwords, since they avoid risks like password reuse or phishing that specifically target traditional passwords. ## Key takeaways - Authentication is the process of verifying a user's identity, distinct from authorization, which determines what they're allowed to do. - Multi-factor authentication combines multiple verification methods, significantly increasing security over a single factor alone. - Passwordless authentication methods (biometrics, security keys) can replace traditional passwords for stronger or more convenient security. - Microsoft Entra ID supports multiple authentication methods, letting organizations configure the security level appropriate for their needs. ## FAQ **What's the difference between authentication and authorization?** Authentication verifies who a user or application is, typically through a sign-in process. Authorization determines what that verified identity is then permitted to do. Authentication happens first; authorization follows once identity is confirmed. **What is multi-factor authentication?** It's an authentication method requiring more than one type of verification — such as a password plus a code from a phone app — significantly increasing security compared to relying on a single factor alone, since an attacker would need to compromise multiple factors, not just one. **Is passwordless authentication secure?** Yes — passwordless methods like biometrics or physical security keys can be more secure than traditional passwords, since they avoid risks specific to passwords, like reuse across sites or susceptibility to phishing attacks. --- Interactive version with quiz and diagrams: https://courseiva.com/learn/az-900/azure-authentication