01
The decision in brief
Keep Entra ID governing the estate. Add SenseCrypt IdP where the sign-in method itself is the problem, through the federation route that matches your users: partner guests, External ID customers, or your own workforce.
Choose Entra ID when
you need the directory, licensing, Conditional Access and device compliance that every Microsoft product your users open already depends on.
Choose SenseCrypt IdP when
you want passwordless face sign-in for a defined population, or you are building a new application with no Microsoft estate behind it.
Side by side
| Dimension | SenseCrypt IdP | Microsoft Entra ID |
|---|---|---|
| What you buy | An identity provider built around a live face check | Cloud identity for workforce and external users |
| End-user sign-in | QR or passkey in the SenseCrypt Authenticator app; no password | Several methods; varies by license and policy |
| Phishing resistance | On the passkey method, via FIDO2/WebAuthn origin binding | Depends on the methods and policies you configure |
| Policy and devices | Not in scope | Conditional Access, device compliance, licensing |
| Working together | Federates by scenario: guests, External ID or workforce | Direct federation, External ID providers, external methods |
| List price | $1 per user per month; 20-seat minimum | Varies by license |
What you buy
- SenseCrypt IdP
- An identity provider built around a live face check
- Microsoft Entra ID
- Cloud identity for workforce and external users
End-user sign-in
- SenseCrypt IdP
- QR or passkey in the SenseCrypt Authenticator app; no password
- Microsoft Entra ID
- Several methods; varies by license and policy
Phishing resistance
- SenseCrypt IdP
- On the passkey method, via FIDO2/WebAuthn origin binding
- Microsoft Entra ID
- Depends on the methods and policies you configure
Policy and devices
- SenseCrypt IdP
- Not in scope
- Microsoft Entra ID
- Conditional Access, device compliance, licensing
Working together
- SenseCrypt IdP
- Federates by scenario: guests, External ID or workforce
- Microsoft Entra ID
- Direct federation, External ID providers, external methods
List price
- SenseCrypt IdP
- $1 per user per month; 20-seat minimum
- Microsoft Entra ID
- Varies by license
02
Why the sign-in method deserves its own decision
Entra ID is wired into licensing, device management, Conditional Access and every Microsoft product your users open in the morning. None of that moves because you changed how a person proves they are present, which is why replacement is usually the wrong frame for this comparison.
The sign-in method still matters. Microsoft's 2024 Digital Defense Report recorded a 146 percent rise in adversary-in-the-middle phishing attacks: the technique that sits between a user and a real sign-in page and relays whatever the user supplies, including a one-time code.
Origin binding addresses that relay threat, so compare the WebAuthn methods configured on both platforms. In SenseCrypt IdP that is the passkey method. The QR method removes password entry but is not origin-bound, so it does not by itself stop a relay.
Passkeys provide the origin binding
FIDO2/WebAuthn passkeys presented by the app as a cross-device authenticator, with a live face check before each assertion.
Enterprise webcam, on request
Simple Webcam runs only in a licensed enterprise deployment, where captures are processed inside that deployment on secure terminals, because unsecured terminals expose webcam capture to injection attacks. It does not add an enrolled-phone possession factor.
No enrollment on the target device
The browser, kiosk or shared desktop being signed in to needs no enrollment, agent or driver. Only the user's own phone is enrolled.
03
Which Entra scenario are you in?
How SenseCrypt IdP reaches Entra ID depends on who is signing in, and the routes are not interchangeable. Guest users from a partner domain use direct federation, which Entra offers over SAML or WS-Federation; SenseCrypt IdP federates over SAML 2.0. Customers in an External ID tenant use a custom OIDC or SAML identity provider. Your own workforce uses domain federation over SAML 2.0; where you want an added factor rather than federated sign-in, Microsoft's external authentication methods are the route to evaluate.
Each route has different scoping, routing and Conditional Access behavior. Conditional Access still runs in Entra ID, but whether it treats the SenseCrypt IdP sign-in as satisfying an MFA requirement depends on the route; confirm this in your tenant before you rely on it.
Whichever route applies, the work is configuration on both sides, with no connector to install, and Entra ID keeps the directory, groups, policy and session. The Entra ID integration guide walks through the routes.
Workforce federation is per domain
Federating a managed domain applies to the users in that domain, not to a hand-picked group. Plan a pilot with a test domain or Microsoft's documented staged-rollout options.
Keep users in step with SCIM
SCIM 2.0 provisioning creates, updates and deactivates users and groups in SenseCrypt IdP from your source of record. Provisioning creates the account; each user still enrolls their face and phone.
New applications can skip the layer
A new customer-facing application with no Microsoft estate behind it can integrate SenseCrypt IdP directly over OIDC.
04
SenseCrypt IdP at a glance
05
Frequently asked questions
Should we replace Entra ID with SenseCrypt IdP?
In an established Microsoft estate, almost certainly not. Entra ID carries licensing, device management and Conditional Access that a sign-in change does not touch. Federation is the arrangement that makes sense: Entra ID keeps the directory and the session, and SenseCrypt IdP runs the authentication. Direct integration is worth considering for a new application with no Microsoft estate behind it.
Which protocol federates SenseCrypt IdP into Entra ID?
It depends on the scenario. Workforce domain federation and direct federation for partner-domain guests use SAML 2.0 with SenseCrypt IdP (Entra also offers WS-Federation, which SenseCrypt IdP does not implement); an External ID customer tenant accepts a custom OIDC or SAML provider. Where you want an added factor rather than federated sign-in, Microsoft's external authentication methods are the route to evaluate. Follow Microsoft's current documentation for the route that matches your users.
Does Conditional Access still apply?
Conditional Access still runs in Entra ID. Whether it treats the SenseCrypt IdP sign-in as satisfying an MFA requirement depends on the federation route, so confirm this in your tenant before you rely on it.
Does this put biometric data in our Microsoft tenant?
No face images or biometric templates go to Entra ID; it receives a standard token or assertion. On the SenseCrypt IdP side, what is stored is listed in the panel above and on What each product retains.
Can Windows sign-in itself use face sign-in?
SenseCrypt IdP authenticates browser-based and federated sign-ins, not the Windows desktop logon. Desktop logon on managed Windows devices stays a Microsoft capability. If you have a specific desktop scenario in mind, ask before assuming it is in scope: sales@seventhsense.ai.