Step-up authentication
Step-up authentication requires stronger authentication than an existing session has established before allowing a protected action or higher-assurance session.
Stronger authentication before a sensitive action
Being signed in may be enough to read a directory but not to change payroll details. Step-up asks for stronger authentication before the more sensitive action. NIST describes it as raising a session’s authentication assurance level.
The application must still check authorization. Stronger authentication does not give someone permission to change another employee’s bank details.
How an application asks for it
Microsoft Entra authentication context lets applications apply Conditional Access policies to particular actions or data. The application maps the operation to a context, checks for that context in the token’s acrs claim, and issues a claims challenge if it is missing. The client then requests a token that satisfies the context.
The context needs an appropriate policy behind it. Microsoft documents that a context claim can be issued even when no Conditional Access policy is assigned to it. Finding the claim in a token does not, on its own, prove that stronger authentication occurred.
A context can also require device compliance. That is a policy condition, not another authentication factor.
Stronger is different from more recent
Reauthentication can ask someone to sign in again without requiring a stronger method. Step-up changes the assurance required; the two can happen together.
The server must enforce the requirement on the protected operation. A prompt in the browser is not enough if the API still accepts the change without the required authentication.