The Evolution of Authentication

Authentication has come a long way.

For decades, proving your identity meant remembering a password. If you knew the password, you were trusted.

It was simple.

It was familiar.

It was also one of the weakest foundations modern security could have been built upon.

Today’s authentication landscape looks very different. Passwords are gradually disappearing, phishing-resistant authentication is becoming the expectation, and organisations have more authentication choices than ever before.

Understanding how we got here helps explain why Authentication Assurance has become so important.

Passwords were never enough

Passwords were designed for a different era.

They assumed users could create strong, unique secrets and remember them across every service they used.

Reality was very different.

Users reused passwords.

Passwords were written on sticky notes.

Simple passwords were chosen because they were easier to remember.

Attackers quickly adapted.

Credential stuffing.

Password spraying.

Brute force attacks.

Phishing.

The password itself became one of the easiest parts of an identity to compromise.

Organisations responded by introducing increasingly complex password policies.

Longer passwords.

Complexity requirements.

Regular password changes.

Unfortunately, these often frustrated users more than they improved security.

The arrival of Multi-Factor Authentication

Multi-Factor Authentication (MFA) was the first major step forward.

Instead of relying solely on something you know, organisations introduced a second factor.

Something you have.

Or something you are.

Microsoft Authenticator notifications, SMS codes, phone calls and hardware tokens all became common.

Compromising an account became significantly harder.

Or so we thought.

Attackers adapted again.

MFA isn’t the end of the story

Traditional MFA solved many problems, but it created new ones.

Users became accustomed to approving notifications without thinking.

Attackers used MFA fatigue attacks.

Phishing kits began capturing both passwords and one-time codes.

Session tokens were stolen.

Adversary-in-the-Middle attacks bypassed traditional MFA altogether.

MFA remained an essential security control.

But simply enabling MFA no longer guaranteed a high level of assurance.

The industry needed something stronger.

Enter passwordless authentication

Rather than improving passwords, vendors began asking a different question.

What if we removed passwords altogether?

Passwordless authentication shifted the focus away from secrets that users had to remember.

Instead, authentication became based on trusted devices, biometrics and cryptographic credentials.

Users could authenticate using:

• Windows Hello for Business
• Microsoft Authenticator
• Platform passkeys
• Security keys

The experience became both simpler and more secure.

Passkeys changed everything

Passkeys represent one of the biggest advances in authentication for many years.

Unlike passwords, passkeys cannot simply be guessed or reused.

Unlike traditional MFA, they are resistant to phishing.

Authentication becomes a cryptographic exchange between the user’s authenticator and the service they’re signing into.

The user no longer proves knowledge of a password.

Instead, they prove possession of a trusted credential.

For most users, this is a huge improvement in both security and usability.

But as we’ll explore later in this series, not all passkeys provide the same level of operational assurance.

Phishing-resistant authentication

Modern identity security increasingly focuses on phishing resistance.

Rather than asking whether an identity uses MFA, organisations should begin asking whether the authentication method can realistically be phished.

Microsoft Entra now supports authentication methods capable of providing phishing-resistant authentication, including:

• FIDO2 Security Keys
• Windows Hello for Business
• Passkeys
• Microsoft Authenticator passkeys

These significantly reduce many of the attack techniques used against traditional credentials.

More choice means more responsibility

Modern authentication gives organisations unprecedented flexibility.

That’s a good thing.

It also introduces complexity.

Not every authentication method is appropriate for every identity.

A method that works perfectly for an everyday user may not provide sufficient assurance for a Global Administrator.

Likewise, requiring dedicated hardware security keys for every employee may be operationally unnecessary.

The challenge is no longer choosing the strongest technology.

The challenge is choosing the right technology for the identity you’re protecting.

Authentication keeps evolving

Authentication will continue to evolve.

New authentication methods will emerge.

Attack techniques will continue to adapt.

What shouldn’t change is the principle behind Authentication Assurance.

As the impact of an identity increases, so should the confidence required before granting access.

The technology may change.

The principle remains the same.

What’s Next?

We’ve seen how authentication evolved from passwords to passwordless authentication and why that journey has significantly improved security.

The next question is one many organisations are asking today.

What exactly is a passkey, and how does it actually work?

In the next article we’ll explore modern passkeys, the different types available, and why understanding them is essential before deciding which is appropriate for your organisation.