Security incident on record — Storm-0558 July 2023 — stolen MSA signing key forged tokens for Exchange Online; CSRB called breach preventable
▪ Editorial verdict
Microsoft Entra MFA is the strongest MFA platform for Microsoft-first organisations. The native Conditional Access integration, passkey and FIDO2 support that is GA since 2024, Intune device compliance enforcement, and Privileged Identity Management for admin accounts create the most complete MFA implementation available within the Microsoft ecosystem.
The Storm-0558 July 2023 incident affected Azure identity infrastructure and should be reviewed by buyers. For organisations whose primary identity infrastructure is Microsoft, Entra MFA at the E5 tier is the most complete MFA solution with the lowest additional cost. For organisations with diverse non-Microsoft infrastructure, Cisco Duo offers better cross-platform support.
The verdict: Microsoft Entra MFA is right for Microsoft-first enterprises wanting the most complete MFA integrated into their existing identity infrastructure. Organisations with diverse infrastructure should evaluate Cisco Duo or Okta Verify.
Passkeys (FIDO2) are GA since 2024. Certificate-based authentication built-in. Number matching Authenticator push. Scored 5 because Microsoft has the most comprehensive and deployable phishing-resistant MFA options.
Sources: Microsoft Entra documentation, CISA MFA guidance
Factor breadth & fallback
5 / 5
FIDO2, passkeys, certificate, push, TOTP, SMS, voice, temporary access pass. Scored 5 for the widest available factor breadth.
Sources: Microsoft Entra documentation
OPERATIONSStrong
Adaptive & risk-based policies
5 / 5
Conditional Access with 200+ risk signals — device compliance, user risk, sign-in risk, location, app sensitivity. Scored 5 for the most sophisticated adaptive access policy engine of any MFA vendor.
Sources: Microsoft Conditional Access documentation
Device posture integration
5 / 5
Native Intune MDM integration — Conditional Access checks device compliance at every authentication. Scored 5 for best-in-class native device posture enforcement.
Sources: Microsoft Entra documentation
ANALYTICSStrong
Authentication telemetry
5 / 5
Sign-in logs, audit logs, and risk detection events in Microsoft Entra. Full Microsoft Sentinel integration. Scored 5 for the deepest authentication telemetry and SIEM integration.
Sources: Microsoft Entra documentation
TRUST & ECOSYSTEMStrong
Admin & privileged protections
5 / 5
Privileged Identity Management (PIM) enforces just-in-time MFA elevation for admin roles. Scored 5 because PIM combined with Conditional Access provides the strongest admin-specific protection in the category.
Sources: Microsoft Entra PIM documentation
Strongest: Phishing-resistant factors
Watch out for: Admin & privileged protections
Strengths & limitations
Strengths
●Included in Microsoft 365 — zero additional MFA cost for eligible
●Passkey (FIDO2) GA 2024 — phishing-resistant authentication now standard
●Conditional Access — most sophisticated policy engine of any MFA vendor
Watch out for
●Best in Microsoft-only environments
●Advanced features (P2) require additional licensing