How built-in and custom authentication strengths define which method combinations satisfy a policy.
From Ultra Transcenders AB-650 by Tony Rough (coming November 2026)
An authentication strength is a Conditional Access grant control that names the combinations of methods a user may use to reach a resource. It builds on the Authentication methods policy: a method must be enabled there before a strength can use it. It needs Microsoft Entra ID P1.
There are three built-in strengths, which cannot be edited, and custom strengths for exact needs.
| Method combination | MFA strength | Passwordless MFA strength | Phishing-resistant MFA strength |
|---|---|---|---|
| FIDO2 security key | Yes | Yes | Yes |
| Windows Hello for Business or platform credential | Yes | Yes | Yes |
| Certificate-based authentication (multifactor) | Yes | Yes | Yes |
| Microsoft Authenticator (phone sign-in) | Yes | Yes | No |
| Temporary Access Pass | Yes | No | No |
| Password plus something the user has | Yes | No | No |
| SMS sign-in, password alone, single-factor certificate | No | No | No |
Limits to remember:
Common trap: A phishing-resistant strength stops a user from entering a password - it does not; the password step still happens and the strength is then enforced as a grant control.
This note is one section of Ultra Transcenders AB-650: Administering Microsoft 365 and AI Services, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.
Due on Amazon in November 2026, in Kindle and paperback editions.
About the book · AB-650 terms in the glossary · All AB-650 study notes
Which groups can carry licences, who can assign them and how membership drives access.
How administrative units scope roles to a subset of users, groups and devices.
How a Conditional Access policy combines assignments, conditions and access controls.
What the harmless phishing simulations are, and the licence and permissions needed to run them.
What the Copilot policy location is, which template offers it and the controls it provides.
How SharePoint data access governance reports and Purview data risk assessments help to find oversharing.
The three audience options for when tenant users receive new features, and where Frontier fits.
Where Copilot issues are tracked: Service health for incidents and Message center for changes.