MSDEVBUILD / azure

Authentication: SSO, MFA and Passwordless

🔑Something you knowpassword or PIN📱Something you havephone, security key👆Something you arefingerprint, face✓ Signed in safelyMFA = two or more of these. A stolen password alone is not enough.
Something you know, something you have, something you are: combine them and a stolen password is useless.

😟 THE PROBLEM

Phished passwords let attackers walk straight into accounts.

😊 THE SOLUTION

Turn on MFA, single sign-on and passwordless sign-in.

  • Phished passwords✓ MFA needs a second factor
  • Too many logins✓ Single sign-on
  • Weak, reused passwords✓ Passwordless: Hello, passkeys
🛠️ Solved with: SSO · MFA · Passwordless
Module 2: Architecture & Services ⏱ 7 min read Updated 11 Nov 2026

Quick answer

Authentication proves who you are. Single sign-on (SSO) lets you sign in once to access many apps. Multifactor authentication (MFA) requires two or more kinds of proof: something you know, something you have, something you are. Passwordless methods, such as Windows Hello for Business, the Microsoft Authenticator app and FIDO2 security keys (passkeys), replace passwords with stronger, easier options.

Exam objective: 2.4.2 Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless. (Skills measured as of July 20, 2026)

Start with a question

A hacker has your password. Can they get into your account?

Without MFA, yes. With MFA, they also need your phone or your fingerprint, and they don’t have those.

Explain it like I’m 10

The technical explanation

Single sign-on

  • One identity, many apps
  • Fewer passwords to remember
  • Easier to remove access when people leave

Multifactor authentication

  • Know: password, PIN
  • Have: phone, key
  • Are: fingerprint, face

Passwordless

  • Windows Hello for Business
  • Microsoft Authenticator
  • FIDO2 security keys and passkeys
Three ways Azure makes sign-in easier and safer

Real-world business scenario

Education

A university

The problem
Student accounts were regularly phished and used to send spam.
What they used
Microsoft Entra MFA with the Authenticator app, and passkeys for staff.
Why that choice
A stolen password alone no longer grants access.
The result
Compromised accounts dropped sharply.

When to use it and when not to

✓ Use it when…

  • MFA for every user, especially admins.
  • SSO for all business apps.
  • Passwordless where devices support it.

✕ Think twice when…

  • Relying on passwords alone.
  • SMS-only MFA for privileged accounts.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is the difference between authentication and authorization?

Model answer

Authentication checks who you are, like showing your ID. Authorization checks what you are allowed to do, like which rooms your ID card opens.

Intermediate Why is MFA so important?

Model answer

Passwords get phished, guessed or leaked. MFA adds a second factor, like an app approval or fingerprint, so a stolen password alone is not enough. Microsoft reports that MFA blocks the vast majority of account-compromise attacks.

Experienced developer Which MFA methods would you recommend and why?

Model answer

Phishing-resistant methods first: FIDO2 security keys or passkeys, and Windows Hello for Business. Then the Microsoft Authenticator app with number matching. Avoid SMS and voice calls where possible because they can be intercepted or SIM-swapped.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which authentication method requires two or more types of verification?

Question 2

Question 2 of 3 · Select 2

Which TWO are passwordless sign-in methods?

Question 3

Question 3 of 3

What does single sign-on allow?

Quick revision

Key points

  • SSO = sign in once, access many apps.
  • MFA = two or more factors (know, have, are).
  • Passwordless options are Windows Hello for Business, Microsoft Authenticator and FIDO2 keys.
  • Authentication ≠ authorization.

Important terminology

Authentication
Proving who you are (AuthN).
Authorization
Deciding what you are allowed to do (AuthZ).
MFA
Requiring two or more of something you know, have or are.
Passwordless
Signing in without a password, using biometrics, a device or a security key.

Common mistakes

  • Mixing up authentication (who) and authorization (what).

Exam tips

  • "Something you know, have, are" = MFA.
  • "Sign in once for many apps" = SSO.

Five quick revision questions

  1. 1.What does SSO stand for?Show

    Single sign-on.

  2. 2.What are the three MFA factor types?Show

    Something you know, something you have, something you are.

  3. 3.Name two passwordless methods.Show

    Windows Hello for Business and FIDO2 security keys (also Microsoft Authenticator).

  4. 4.Is a password plus a security question MFA?Show

    No, both are something you know.

  5. 5.Authentication or authorization? Deciding which files you can open.Show

    Authorization.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: External Identities