How to Configure Microsoft Entra ID Authentication Context for Step-Up MFA

Traditional Conditional Access policies in Microsoft Entra ID (formerly Azure AD) typically enforce rules at the application boundary. When a user authenticates to an application (e.g., SharePoint or Salesforce), the policy evaluates their risk, network, and multi-factor authentication (MFA) status. However, this “all-or-nothing” approach is insufficient for highly sensitive internal operations. What if you want users to access general SharePoint sites with standard MFA, but require a FIDO2 hardware key or biometric authentication specifically when they attempt to download highly classified financial documents?

Microsoft Entra Authentication Context solves this. It allows administrators to enforce granular, step-up authentication conditionally based on the specific data or action a user is trying to access within an application, rather than just at the login screen.

This guide explains how to architect, configure, and enforce an Authentication Context in Entra ID and apply it to a sensitive SharePoint Online site.

Understanding Authentication Context

Authentication Context operates as a bridge between your data (labelled via Microsoft Purview or SharePoint sensitivity labels) and your Conditional Access policies.

The workflow relies on three steps:

1. Define the Context: You create a logical tag in Entra ID (e.g., “High Confidentiality”).
2. Create the Policy: You create a Conditional Access policy that states: “Anyone attempting to access data tagged with ‘High Confidentiality’ must use a Phishing-Resistant MFA method.”
3. Tag the Resource: You apply the “High Confidentiality” tag to a specific SharePoint site, Microsoft Purview label, or custom API.

Step 1: Creating the Authentication Context in Entra ID

The first step is establishing the context definition in the Entra ID admin center.

1. Navigate to the Microsoft Entra admin center.
2. Go to Protection > Conditional Access > Authentication context.
3. Click New authentication context.
4. Name: Require Phishing-Resistant MFA.
5. Description: Enforces FIDO2 or Windows Hello when accessing highly sensitive internal resources.
6. Leave the Publish to apps checkbox checked.
7. Click Save.

Step 2: Building the Step-Up Conditional Access Policy

Now, we create the policy that enforces the strict authentication requirement whenever the context is triggered.

1. Go to Protection > Conditional Access > Policies.
2. Click New policy.
3. Name: Enforce Step-Up MFA for Authentication Context.
4. Under Users, select All users (or a specific pilot group).
5. Under Target resources, click the dropdown that says Cloud apps and change it to Authentication context.
6. Check the box next to the context you created: Require Phishing-Resistant MFA.
7. Under Grant, select Require authentication strength.
8. Choose Phishing-resistant MFA from the dropdown menu (this enforces FIDO2, Windows Hello, or Certificate-Based Authentication).
9. Enable the policy and click Create.

Step 3: Applying the Context to a SharePoint Site

With the context and policy defined, we must now apply it to a sensitive resource. We will use SharePoint Online PowerShell to bind the context to a specific site collection housing confidential financial data.

First, you need the unique ID of the Authentication Context. In the Entra ID portal, go back to Authentication context and copy the ID (it will look like c1... or c2...).

Open an elevated PowerShell session and connect to SharePoint Online:

Connect-SPOService -Url https://yourtenant-admin.sharepoint.com

Apply the Authentication Context to the specific highly-classified site:

Set-SPOSite -Identity https://yourtenant.sharepoint.com/sites/FinancialData -ConditionalAccessPolicy AuthenticationContext -AuthenticationContextName "c1"

(Replace “c1” with the exact ID of your Authentication Context).

Step 4: The End-User Experience

When an employee logs into SharePoint in the morning, they will use their standard authentication method (e.g., password and SMS/Authenticator App). They can browse the corporate intranet, view HR policies, and read news feeds normally.

However, the moment they click the link to navigate to the /sites/FinancialData site, SharePoint evaluates the site’s configuration. Recognizing the bound Authentication Context, SharePoint redirects the user back to Microsoft Entra ID with an authorization challenge.

Entra ID evaluates the Conditional Access policy tied to that context, realizes the user has not satisfied the “Phishing-Resistant MFA” requirement in their current session, and halts their access. The user is presented with a prompt: “To access this site, you must use a more secure authentication method.”

The user must then insert their YubiKey or use Windows Hello biometric authentication. Once satisfied, Entra ID issues a stepped-up token, and the user is permitted into the financial data site.

Conclusion

Microsoft Entra Authentication Context provides an incredibly powerful mechanism for Zero Trust enforcement. By moving Conditional Access evaluations away from broad application boundaries and tying them directly to data sensitivity, organizations can impose frictionless security for daily tasks while mathematically guaranteeing high-assurance authentication when accessing critical enterprise IP.