Identity Impersonation Detection White Paper Read Now
Two layers of the same stack. Entra ID authenticates credentials and manages access. Trusona verifies that the person on the call is the real account holder.
Trusona and Microsoft Entra ID solve different parts of the same problem. Entra ID handles authentication, MFA, conditional access, and password reset for users who already have credentials. To verify the actual person at the help desk or recover an account with all methods lost, Microsoft uses Entra Verified ID and Face Check: a government-ID check plus a real-time selfie, through a pre-issued credential and the Microsoft Authenticator app. Trusona verifies a government ID against the authority that issued it, in real time, with no credential, no app, no selfie, and no PII stored.
The caller scans a government ID. Trusona verifies it against the authority that issued it, in the US the state DMV over the AAMVA network, and returns the result to the agent in real time. It works worldwide across 2,500+ document types, detects SIM swaps and port-outs, blocks man-in-the-middle attacks, stores no PII, and asks the caller for no app and no selfie.
Entra ID authenticates users who already have credentials, with MFA, conditional access, and self-service password reset. To verify the person at the help desk or recover a locked-out account, Microsoft uses Entra Verified ID with Face Check: the caller presents a pre-issued credential in Microsoft Authenticator and takes a real-time selfie matched in the cloud against a government-issued ID. Face Check is a paid add-on. We break down Verified ID and Face Check in detail.
Entra ID answers one question: does this person hold the right credentials? Microsoft's identity-proofing layer, Verified ID with Face Check, answers a second: is this the real person, using a government ID plus a real-time selfie and liveness. Trusona answers that second question without a face at all. It verifies the government ID against the authority that issued it, in real time. Trusona's position is that a selfie is a surface generative AI is built to attack, so it removes the face from the decision and checks the source of truth instead.
| Capability | Trusona ATO Protect | Microsoft Entra ID |
|---|---|---|
| Verifies the government ID against the issuing authority, in real time | Yes (US: DMV via AAMVA) | Via a third-party IDV partner + Face Check, mapped to your directory |
| Requires a live selfie or liveness biometric | No selfie | Yes (Face Check) |
| Requires the Microsoft Authenticator app and a pre-issued credential | No | Yes |
| Identity verification included, not a paid add-on | Included | Face Check is a paid add-on (Entra Suite or standalone) |
| Works with a first-time caller, no pre-registration | Yes | No, credential must be issued first |
| SIM-swap and port-out detection | Yes | Not published |
| Patented man-in-the-middle and anti-replay detection | Yes (US Pat. 10,601,859) | Not published |
| Reverse check: caller verifies the agent | Yes (Agent Verify) | Not published |
| Personal data stored | None (SOC 2) | Directory profile and credentials; ID data handled by the IDV partner you choose |
Comparison based on each company's public product materials as of July 2026, including Microsoft's Entra Verified ID, Face Check, and account recovery documentation. "Not published" means a capability that Microsoft does not describe on its public pages, not confirmation that it is absent.
Six more side-by-side breakdowns of Trusona against the tools teams evaluate for help desk identity verification.