Azure AD Authentication

Question 1

What is authentication?

Answer 1

The process of verifying an identity to be legitimate.

Question 2

What is authorization?

Answer 2

Verifying what access a user has.

Question 3

What is MFA?

Answer 3

Multi-factor authentication (MFA) is an authentication method that requires two of the following:

• Something you know (Ex: password)
• Something you have (phone, hardware key)
• Something you are (biometrics)

Question 4

What are the four additional authN methods Azure AD provides?

Answer 4

Microsoft Authenticator app
OATH Hardware token
SMS
Voice Call

Question 5

Can admins disable certain authN methods?

Answer 5

Yes.

Question 6

What is passwordless authN?

Answer 6

A authN method based on something you are.

Question 7

What are the three passwordless options?

Answer 7

• Microsoft Authenticator Fingerprint Scan
• FIDO2 Security Key
• Windows Hello

Question 8

What is Windows Hello?

Answer 8

A authN feature built in Windows 10 that uses biometric verification (fingerprint, face) or Pin.

It is tied to a device, not profile, and authenticates to MS Accounts, AD/ Azure AD accounts or/and Any Identity Provider that supports FIDOv2.0

Question 9

Why is Windows Hello secure?

Answer 9

Because the biometric/Pin is tied to the device, so a bad actor would need hardware and pin/biometric proof to unlock.

In addition, the Biometric data/pin is stored on the local device so a hacker can’t intercept it over the network.

Question 10

Is the Windows Hello pin backed by a Trusted Platform Module (TPM) chip?

Answer 10

Yes.

Question 11

What are the key features of Windows Hello for Business?

Answer 11

• Configured by group policy or MDM
• Always uses key-based or certificate-based authentication
• Pin authentication is disabled by default.