Authentication strength
In Microsoft Entra Conditional Access, an authentication strength specifies the combinations of authentication methods a user may use to satisfy a resource-access requirement.
Choose acceptable methods for a particular resource
Microsoft Entra has three built-in strengths: MFA, passwordless MFA, and phishing-resistant MFA. Administrators can also define custom combinations.
The Authentication methods policy enables methods for users and groups. An authentication strength narrows which combinations satisfy a Conditional Access requirement. Enabling a method does not mean it meets every resource’s access policy.
Passwordless and phishing-resistant are different categories. Authenticator phone sign-in qualifies as passwordless MFA. The phishing-resistant strength includes FIDO2 security keys, Windows Hello for Business or platform credentials, and certificate-based authentication configured for multifactor use.
Why a password prompt can still appear
Entra evaluates Conditional Access after initial authentication. A user can enter a password first and still need an allowed stronger method before continuing to the protected resource.
For troubleshooting, inspect the applied policy and authentication details. A screenshot of the first prompt cannot show whether the final requirement was satisfied. “Authentication strength” names this Entra control; it is not a universal rating of sign-in security.