Microsoft Entra ID MFA without codes or prompts
NearAuth.ai plugs into Microsoft Entra ID as an external authentication method. People sign in to Microsoft with their password or passkey, and then Microsoft asks NearAuth.ai whether their own phone is with them, in place of the usual MFA prompt. No Authenticator codes, no number matching.
How it works
First factor at Microsoft
The person signs in to Microsoft as usual. Nothing about their account or password changes.Second factor at NearAuth.ai
Conditional Access requires MFA, and Entra ID sends the person to NearAuth.ai, which checks that their phone is next to their computer.Back to Microsoft
With the phone nearby, they're in. With it in another room, they don't get straight in.Setup in five steps
About 30 minutes, with a Global Administrator. Your NearAuth.ai admin console shows the exact values to paste. The sign-up guide has every click.
- Connect your tenant. On NearAuth.ai's Microsoft Entra ID page, grant consent as a Global Administrator. NearAuth.ai can then read your groups and users, manage the NearAuth group's members, check that accounts are still enabled, and end Microsoft sessions when a person's devices are reset.
- Create an empty security group, for example "NearAuth users," and choose it in NearAuth.ai.
- Add the external method. In the Entra admin center, under Authentication methods > Policies, add an external method with the client ID, discovery endpoint and app ID from your guide. Target only the NearAuth group.
- Create the Conditional Access policy. Include the NearAuth group, exclude your break-glass accounts, and grant access with "Require multifactor authentication." Start in report-only mode.
- Test, then switch it on. Sign in once with your phone nearby and once with it in another room. Then add everyone whose phone is set up.
Why use it in place of Microsoft Authenticator prompts?
- Nothing to approve by mistake. Push flooding and relayed codes both depend on a person approving something. Here there's no code or approval to ask for. See token spraying and help-desk passkey scams against Microsoft 365.
- It keeps checking. Presence is re-checked through the day. Set a sign-in frequency in Conditional Access and Microsoft checks back with NearAuth.ai on that schedule.
- Time back. No reaching for the phone at every sign-in. Work out your number.
- A record per person. Every check is logged with the person, computer, IP address and time.
What it doesn't do
- It needs Entra ID P1 or higher. Microsoft 365 Business Standard doesn't include Conditional Access.
- External methods don't count toward authentication strengths, so a policy that demands a specific strength won't accept it.
- A sign-in frequency of one hour is quiet on Windows PCs joined to Entra and on Macs with Microsoft single sign-on. On other computers Microsoft also asks for the password each time, so keep Microsoft's default there.
- Every person needs the NearAuth.ai app on their phone and on their Mac or Windows computer, with Bluetooth on.
Using Google instead? See NearAuth.ai for Google Workspace. Comparing options? See how NearAuth.ai compares with MFA and continuous authentication.
Microsoft, Entra and Microsoft 365 are trademarks of the Microsoft group of companies. NearAuth.ai is not affiliated with Microsoft.
Frequently asked questions
What is an external authentication method in Microsoft Entra ID?
It is Microsoft's way of letting an outside provider supply the second factor. When a Conditional Access policy requires multifactor authentication, Entra ID sends the person to the external provider after their first factor and accepts its answer in place of Microsoft's own MFA prompt.
How does NearAuth.ai work with Entra ID?
People sign in to Microsoft as usual, with their password or passkey. Microsoft then asks NearAuth.ai to confirm that the person's own phone is next to their own computer. With the phone nearby that is a quick redirect, with no code and no push approval.
Which Microsoft licence do we need?
Microsoft Entra ID P1 or higher, for Conditional Access. It is included in Microsoft 365 Business Premium, E3 and E5, but not in Business Standard.
Does it work with Conditional Access authentication strengths?
No. External authentication methods don't count toward authentication strengths. Use the 'Require multifactor authentication' grant in the Conditional Access policy instead.
Can we roll it out to a few people first?
Yes. The external method and the Conditional Access policy both target one Entra security group. Start the policy in report-only mode, test with your own account, then add people as their phones are set up. To undo it for one person, take them out of the group; for everyone, turn the policy off.
What should we do about break-glass accounts?
Keep two emergency administrator accounts that never sign in through NearAuth.ai, exclude them from the Conditional Access policy, and protect them with long passwords and a hardware security key.
Does it cover Microsoft 365 and the apps that sign in with Microsoft?
Yes. Outlook, Teams, SharePoint and any app that signs in through Entra ID are covered by the same Conditional Access policy. You choose all resources or specific apps.
How much does it cost?
The Essential plan is free for up to 12 users, with no credit card. Advanced is $6 and Enterprise $9 per user per month.
Free for up to 12 people
- The Essential plan is free for teams of up to 12, with Google Workspace or Microsoft 365. No credit card.
- Most teams have their first five people running in about 15 minutes.
- A bigger team? Advanced is $6 and Enterprise $9 per user per month. Book a 15-minute demo and we'll help you roll it out.
Christopher McLain, founder • chris@nearauth.ai • 607-238-3533