Step-up Authentication
Requiring additional authentication when a user attempts a higher-risk action, such as changing email or initiating a large payment. Implemented via OIDC acr_values and amr claims in modern stacks.
Step-up is how you keep everyday access frictionless without leaving sensitive operations protected only by a session from three days ago. Implement it as a property of the action rather than of the login: changing a recovery email, adding a payee, or exporting data should each declare the assurance they require, and the application should ask for it at that moment.
See also: adaptive auth, risk-based auth, MFA, SCA
Related on Start with Identity
- GlossaryTwo-Factor Authentication (2FA)
Two-factor authentication (2FA) is sign-in that requires two distinct types of authentication factor, typically a password (something you know) plus a phone, co
- GlossaryConditional Access
Policy-driven access decisions evaluated at sign-in time. Inputs include identity, device, location, risk signals, and application sensitivity. Microsoft Entra
- GlossaryMFA Blind Zone
The MFA blind zone is the set of breaches in which the abused path had no interactive login where MFA could have applied: a service account, API key, token or O
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin