SenseCrypt vs Microsoft Entra ID

Entra ID is wired into licensing, device management, Conditional Access, and every Microsoft product your users open in the morning. None of that moves because you changed how a person proves they are present, which is why replacement is usually the wrong frame for this comparison.

The sign-in method still deserves its own decision. Microsoft's own Digital Defense Report recorded 146 percent year-over-year growth in adversary-in-the-middle phishing in 2024: the technique that sits between a user and a real sign-in page and relays whatever the user supplies, including a one-time code.

There are two coherent answers to that. Bind the credential to the origin so a relay cannot use it, which is what FIDO2/WebAuthn does. Or take the typed secret out of the flow entirely, which is what the face ceremony does. SenseCrypt ships both, and is explicit about which claim belongs to which.

If SenseCrypt sits behind Entra ID, your privacy review is really a review of what SenseCrypt holds. The answer is short. IdP retains quantum-safe, sealed, biometric-free, disposable face tokens and their verifier challenges. Standard OIDC/SAML account records, device public keys, sessions, logs and encrypted tenant signing keys also persist. No face images or templates are retained in the documented phone flow. Licensed on-premises Webcam processes captures inside the customer deployment.

The retained face token is quantum-safe, sealed, biometric-free and disposable. No face images or templates are retained in the documented phone flow. Tokens are tenant-bound and stored alongside the required account records. ISO/IEC 24745:2022 describes the properties being aimed at, and ISO/IEC 30136:2018 describes how template protection performance is measured.

For a Microsoft-centric organization, the practical reading is that adding face login adds sealed, biometric-free, disposable face tokens to the estate rather than a raw face gallery. There is no gallery in the tenant, none in ours, and sealed, biometric-free, disposable face tokens and account records to assess on exit. That is the point of the term biometric-blind.

Entra ID is not really competing for the sign-in ceremony alone. It is the place group membership, licensing, Conditional Access policy and device compliance already live, and moving any of that is a program rather than a procurement.

SenseCrypt has none of that reach and does not aim at it. It covers one ceremony end to end, with the standards to plug that ceremony into whatever governs the rest.

Read the comparison as an addition rather than a substitution, unless you are building something new and have no estate to preserve.

Entra ID accepts an external identity provider, and which protocol applies depends on the tenant configuration you run: Microsoft documents SAML and WS-Federation for direct federation with an external domain, and OpenID Connect for custom identity providers in External ID. SenseCrypt speaks both OIDC and SAML 2.0, so check the current Microsoft documentation for the configuration you have and use the protocol it names.

Whichever route applies, the division of labor is the same. Entra ID stays the front door and keeps the directory, the groups, the Conditional Access policy and the session. SenseCrypt runs the proof: the ceremony completes on the enrolled phone, a standard assertion or token comes back, and Entra ID issues the session exactly as before.

Because it is a federation, not installed software, the work is configuration on both sides: metadata or discovery endpoints, a client or application registration, claim mapping, and the rule that decides who is routed through it.

The protocol surface belongs to the same service that runs the face ceremony, so there is no biometric product and identity provider to keep in step with each other. That is the structural difference between an identity provider with a face and a face bolted onto an identity provider.

Two boundaries worth writing into your design document. End-user authentication keeps no operator-side single sign-on session: every application sign-in is its own ceremony, and the only browser session SenseCrypt maintains belongs to the admin console. And the hash-chained tamper-evident log covers administrative actions in that console; end-user sign-ins appear in a separate read-only activity stream that is not hash-chained and has no self-service verification endpoint.

A seat is a dollar a month, sold in blocks of no fewer than twenty. Non-exportable signing keys in a managed key service cost twenty dollars per key per month, and the key cannot be copied out by anyone, including us. Tenants and custom domains past the three included per account are ten dollars per month each, customer identity deployments meter monthly active users, and the thirty-day trial takes no card.

• OpenID Connect and OAuth 2.0 (RFC 6749), with PKCE (RFC 7636) and pushed authorization requests (RFC 9126)
• SAML 2.0 identity provider for federation and for applications that federate that way
• SCIM 2.0 (RFC 7644) provisioning of users and groups
• FAPI-CIBA / CIBA: a backchannel push starts a face check on the enrolled phone.
• Roles and permissions in the token, a default-closed group gate at sign-in, capability checks on console routes
• Multi-tenant isolation, with three tenants or custom domains included in every account