Authentication Strengths - What They Really Allow
The question it answers: Which authentication strengths used by Conditional Access allow weaker methods than their name suggests?
Conditional Access policies that require an authentication strength are only as strong as the combinations the strength allows. A custom strength called “Phishing-resistant MFA” that also accepts SMS, push or OATH codes quietly downgrades every policy that uses it. The Policy Analyser shows the strength’s name only.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Identity Configuration › Authentication Strengths |
| Workload | Entra ID |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Entra ID P1. |
| Report id (API and MCP) | entra.configuration.authentication-strengths |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Type | Category | Text |
| Strength | Subject | Link |
| Check | Setting | Text |
| Allowed combinations | Value | Text |
| Finding | Finding | Text |
| Used by | Detail | Text |
| Date | When | Date |
| CA policies | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Entra ID P1.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Policy.Read.All | Microsoft Graph | Read your organization’s policies |
Data sources it reads
GET /v1.0/policies/authenticationStrengthPoliciesGET /v1.0/identity/conditionalAccess/policies (cached)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.configuration.authentication-strengths?size=100An AI assistant reads it with the MCP tool get_report and the id entra.configuration.authentication-strengths. The client needs the Read grant for Entra ID. See Using the API.