Previous Azure Redis Cache Azure-IaaS Next

Azure AD (Active Directory) and MFA- Multi-Factor Authentication

🔐 Azure Active Directory (Azure AD)

Azure Active Directory (Azure AD) is Microsoft’s cloud-based identity and access management service. It helps employees sign in and access resources like:

  • Microsoft 365 (Outlook, Teams, SharePoint)
  • Azure portal and cloud resources
  • Thousands of SaaS apps (Salesforce, ServiceNow, etc.)
  • Custom business applications

Key Features

  • Single Sign-On (SSO) across cloud and on-prem apps
  • Role-based access control (RBAC)
  • Conditional Access policies
  • Integration with on-prem Active Directory
  • Supports OAuth2, OpenID Connect, SAML

Common Use Cases

  • Secure access to Microsoft 365 and Azure Portal
  • Federated identity for third-party apps
  • User provisioning and lifecycle management
  • Access governance and compliance

With Azure AD, organizations can manage users, groups, roles, and permissions securely from the cloud.

🛡️ Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) adds an extra layer of security to Azure AD. Instead of only entering a password, users must provide a second form of verification, such as:

  • OTP (One-Time Password) sent via SMS or email
  • Microsoft Authenticator mobile app notification
  • Biometric verification (fingerprint, face recognition)
  • Phone call approval

Benefits

  • Protects against phishing and password attacks
  • Secures remote access and cloud resources
  • Meets compliance requirements (HIPAA, GDPR, etc.)
  • Supports self-service password reset with MFA

📘 Example

A user tries to log in to Office 365 with their Azure AD account:

  1. User enters username and password
  2. Azure AD checks credentials
  3. MFA is triggered → user approves login via Authenticator app
  4. Access is granted securely

Result: Even if the password is stolen, attackers cannot log in without the second authentication factor.

Azure AD + MFA Login Flow

Azure AD Login Flow — Diagram

Visual flow: User → Azure AD → MFA → Application

User Browser / Client Azure Active Directory Credentials verification & token issuance Multi-Factor Authentication (MFA) Authenticator app / SMS / Call / Biometric Application Receives token, grants access Token issued (JWT / SAML)
How it works (short):
  1. User signs in from a browser or client.
  2. Azure AD validates credentials and may require MFA.
  3. MFA prompts the user (authenticator push, SMS, call, or biometric).
  4. After successful MFA, Azure AD issues an access token to the application.
  5. The application accepts the token and grants access to protected resources.

Legend: The diagram shows credential verification and an extra MFA step before the application accepts the token.

Back to Index
Previous Azure Redis Cache Azure-IaaS Next
*