Microsoft recently introduced a powerful new capability in Entra ID called External Authentication Methods (EAM).
For many organizations, this solves a long-standing problem: how to enable Microsoft’s advanced security features without forcing users to abandon the third-party MFA solutions they already know and trust.
For years, enterprises using Okta, Duo, or other MFA providers faced a painful tradeoff. They either had to stick with their current MFA setup—missing out on Microsoft’s built-in security automation—or migrate to Microsoft Authenticator, disrupting user experience and retraining the entire workforce.
The Core Problem Organizations running third-party MFA / IDP have been locked out of some of the most valuable Microsoft security orchestration scenarios. Take this common sequence as an example (Defender > Intune > Entra integration):
- Defender detects a risk on a device
- Intune marks the device as non-compliant
- Entra Conditional Access blocks access to cloud resources
- Defender automatically investigates and remediates the threat
- Defender clears the device risk
- Intune restores compliance
- Entra ID automatically re-allows access
This closed-loop security automation is only possible when Microsoft Entra ID is the primary authority for authentication and authorization.
With third-party MFA in place, organizations couldn’t take advantage of this capability without breaking user experience.
Technical Requirements
To implement External Authentication Methods, organizations will need:
- Microsoft Entra ID P1 or P2 licenses
- Primary user identities stored in Entra ID (not federated)
- A supported MFA provider such as Okta, Duo, or Akamai MFA
- OIDC-compatible integration between Entra ID and the MFA provider
How External Authentication Methods Work
EAM introduces a separation between who manages identity and authorization (Entra ID) and how MFA is performed (third-party provider).
Here’s how it works in practice:
Setup requirements:
- User identities must be managed directly in Microsoft Entra ID (Cloud Apps remains connected to OKTA)
- Third-party/OKTA MFA provider registered as an External Authentication Method
- Conditional Access policies configured in Entra ID
Authentication flow:
- User accesses an application → redirected to Entra ID (from OKTA > Entra for example)
- Entra ID authenticates the primary credential (password or passwordless)
- Conditional Access evaluates device compliance, risk signals, and policies
- MFA is required → Entra ID redirects to the third-party provider (e.g., Okta Verify, Duo)
- User completes MFA with their existing app
- Entra ID receives the result and makes the final authorization decision
- Access is granted with Microsoft’s full security stack active
This design keeps Microsoft in control of the identity and authorization process, while allowing end users to continue with their familiar MFA tools.
The Key Benefits:
The value of EAM is clear for both IT and end users:
Preserve user experience
- No retraining required
- No forced migration to Microsoft Authenticator
- Employees keep using the MFA app they already know
Unlock Microsoft’s integrated security stack
- Real-time Conditional Access tied to device compliance
- Automated threat response with Microsoft Defender
- Risk-based identity protection
- Seamless Intune device management
Enable gradual adoption
- Start with pilot groups
- Test policies safely before rolling out organization-wide
- Maintain business continuity while modernizing security
The Bottom Line
With External Authentication Methods, Microsoft removes the false choice between security innovation and user experience.
Organizations can now enable Microsoft’s advanced security automation while keeping the MFA investments—and the user familiarity—they’ve built over time.
For security teams, this is an important development. It means you can fully leverage Conditional Access, Defender, and Intune without ripping and replacing your existing MFA solution.
EAM provides the bridge to next-generation security automation, allowing organizations to modernize at their own pace while protecting user experience.
Microsoft Entra External Authentication Methods is currently in public preview. Requires Entra ID P1/P2 licensing. Contact your Microsoft representative for implementation guidance.
Want to know where your tenant stands? Griffin31 checks your Microsoft 365 security settings continuously and shows you what to fix first.