Entra Account Recovery

Entra Account Recovery with Third-Party Identity Verification

Key Concepts:

• Passwordless Authentication: Moving away from traditional passwords towards methods like authenticator apps and passkeys.
• Passkeys: Phishing-resistant authentication credentials stored on devices (TPM, mobile devices) – device-bound or synced.
• Verified ID: A decentralized identity created after successful identity verification, used to bootstrap account recovery.
• Self-Service Account Recovery: A new Entra capability allowing users to recover accounts without help desk intervention, based on identity verification.
• Temporary Access Pass (TAP): A short-lived credential generated for users to create a new passkey after successful recovery.
• Decentralized Identity: An identity that the user controls and stores, not centrally managed.
• Liveness Detection: Technology used to verify a user is a real, live person during face checks.

1. The Shift Away from Passwords & Traditional Recovery Methods

Organizations are increasingly moving away from passwords due to security concerns (network secrets, susceptibility to compromise). Passwords are being replaced by passwordless methods like authenticator apps and, more importantly, passkeys. Traditional self-service password reset (SSPR) is becoming less relevant as password reliance decreases. Existing recovery methods like SMS, phone calls, and email codes are vulnerable to phishing and interception, even with technologies attempting to circumvent these attacks. Security questions are now deprecated and unsupported in modern authentication policies.

2. The Benefits and Types of Passkeys

Passkeys offer significant security advantages: they are phishing-resistant because they require physical proximity (NFC, Bluetooth) and are tied to the specific domain for which they were issued. There are two main types:

• Device-Bound Passkeys: Stored locally on a device (e.g., Microsoft Authenticator app on a phone) and do not sync. Loss of the device means loss of the passkey.
• Synced Passkeys: Utilize native ecosystem features (iOS Keychain, Android Wallet) to synchronize across devices within the same ecosystem (iOS to iOS, Android to Android – not cross-platform). This offers convenience but introduces uncertainty about the key’s exact location.

3. The Problem with Lost Credentials & The Role of the Help Desk

Losing a device with a device-bound passkey presents a recovery challenge. While synced passkeys mitigate this, scenarios exist where device-bound keys are preferred or required. Traditionally, account recovery relies on the help desk, which is vulnerable to social engineering attacks. Attackers often target the help desk – the “path of least resistance” – rather than employing complex hacking techniques. The speaker highlighted the increasing sophistication of attacks like deepfakes, making human validation increasingly unreliable. The human element is fallible and susceptible to manipulation, especially during off-hours.

4. Introducing Entra Self-Service Account Recovery

The new Entra self-service account recovery aims to eliminate reliance on passwords, other vulnerable authentication methods, and the help desk. It focuses on identity verification followed by issuing a verified ID that the user can use to reset their account. The current preview focuses on the “total loss” scenario – a user with no other authentication methods available.

5. Step-by-Step Account Recovery Process

1. Initiation: User attempts to log in and selects the "Recover your account" option.
2. Redirection to Identity Verification Service: Entra redirects the user to a configured third-party identity verification provider (e.g., Authentics, Admia, True Credential).
3. Identity Verification: The user provides proof of identity (passport, driver’s license, ID card) and completes a selfie verification. The provider checks document validity, matches the selfie to the document, and detects potential deepfakes.
4. Verified ID Creation: Upon successful verification, the provider creates a decentralized Verified ID containing claims about the user (including a photo) and sends it to the user’s digital wallet (Authenticator app). A QR code is provided for PC users.
5. Entra Verification & Face Check: The user presents the Verified ID to Entra, which performs a liveness detection face check to confirm the user is a real person.
6. User Lookup & Temporary Access Pass (TAP) Generation: Entra verifies the user’s identity against the Graph API (currently using first and last name, with future expansion to include address and other data). If a match is found, a Temporary Access Pass (TAP) is generated.
7. Passkey Creation: The user uses the TAP to bootstrap the creation of a new, synced passkey.

6. Technical Details & Configuration

• Identity Verification Providers: Administrators configure Entra with a supported provider (Authentics, Admia, True Credential) through the Microsoft Security Store.
• Face Check Cost: Entra charges $0.25 per face check performed during the recovery process.
• Evaluation Mode: A preview feature that allows administrators to test the recovery flow without actually issuing a TAP.
• User Account Requirements: First and last name fields must be populated in user accounts for the recovery process to function correctly.
• Future Enhancements: Potential future features include continuation tokens for platform recovery actions, conditional access controls, and targeted recovery profiles.

7. Demonstration & Real-World Example

The speaker demonstrated the process using a fake ID (which failed verification) and then a valid ID (which successfully initiated the process up to the TAP generation stage, which was blocked due to evaluation mode). The example highlighted the importance of accurate user data (first and last name) and the seamless integration with the Authenticator app. The speaker referenced a scenario where a user lost their phone with a device-bound passkey over a bridge, illustrating the need for this recovery mechanism.

8. Notable Quotes

• “We want to move away from we can't reset passwords. We're not using the password. We don't want to rely on other authentication methods. Instead, we want to base it on identity verification of that human being and then give them a verified ID that they can then use to bootstrap creating a new pass key on their device.”
• “The reality is they typically take the path of least resistance and they just kind of would call the help desk and trick them.”
• “Humans are getting flooded with people requesting access. They've got no way to prove it.”

9. Data & Statistics

• The speaker alluded to the prevalence of phishing attacks and the availability of technology on the dark web to intercept SMS and email one-time passcodes.
• The cost of the face check feature is $0.25 per check.

Conclusion:

Entra’s new self-service account recovery capability represents a significant step towards more secure and user-friendly authentication. By leveraging third-party identity verification and decentralized identities, it reduces reliance on vulnerable recovery methods and the fallibility of human help desk agents. While currently in preview, this feature promises to streamline account recovery and enhance the overall security posture of organizations adopting passwordless authentication strategies. The process, while multi-step, is designed to be robust and resistant to common attack vectors, ultimately empowering users to regain access to their accounts securely and independently.