Skip to content
Start with Identity
Join free
Decentralized Identity

Microsoft Entra Verified ID

Founded 2022Redmond, Washington, USAPublic (Microsoft)Score 4.2/5Evaluated 2026-09-20Website ↗

Capability scores

Methodology →
Authentication
4.0
SSO & Federation
4.5
Authorization
3.5
Lifecycle & Provisioning
4.0
MFA & Passwordless
4.0
Governance & Audit
4.0
Developer Experience
3.5
Deployment Flexibility
2.5
Pricing Transparency
3.5
Support & Ecosystem
4.5

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

Microsoft Entra Verified ID is the verifiable credentials service built into Entra ID, letting an organisation issue, verify and revoke digital credentials such as employment proofs or training certifications. It has been generally available since August 2022 and reached a genuinely useful milestone in May 2026 when Entra ID account recovery using Verified ID went GA.

Its commercial position is the strongest argument for it: up to 50,000 transactions per month at no cost, and the service is included with any Entra ID subscription including the free tier. For organisations already on Entra, the barrier to trying verifiable credentials is close to zero.

What it is good at

Distribution and integration. Credentials land in Microsoft Authenticator, which is already deployed across most enterprises, and the service is administered from the same console as the rest of Entra. Account recovery with Verified ID is a rare example of verifiable credentials solving a concrete, everyday enterprise problem rather than a hypothetical one, replacing helpdesk identity-proofing calls with a credential presentation.

Face Check adds biometric matching against the photo in a verified credential, which meaningfully raises assurance for remote onboarding and recovery. Standards coverage on the plumbing is solid, with SIOPv2, OpenID4VP, DIF Presentation Exchange and Well Known DID Configuration all implemented.

Where it falls short

Standards currency is the real weakness. Microsoft implements Verifiable Credentials Data Model v1.1, not v2.0, OpenID4VCI at draft 11, and did:web as the only identifier method. There is no SD-JWT, no SD-JWT VC and no ISO/IEC 18013-5 mDoc support anywhere in its documentation, which puts it out of step with the EU Digital Identity Wallet direction. The standards page itself was last revised in December 2024.

The did:ion removal in December 2023 left anyone who piloted on it needing to reissue every credential, which is a fair warning about betting early on a Microsoft preview trust system.

Face Check billing charges for failed face matches as well as successful ones, and Microsoft publishes no per-verification list price at all.

Adoption is opaque, with no published volume or named references, and GCC High is not supported.

Pricing

50,000 transactions per month free; above that requires Entra ID P1 at 7 dollars or P2 at 10 dollars per user per month. Face Check is included in Entra Suite at 12 dollars per user per month, or pay-as-you-go at an unpublished rate. Model it with our TCO calculator.

Best for, and who should look elsewhere

Choose Verified ID if you already run Entra ID and want workforce credentials or credential-based account recovery at essentially no incremental cost. Look at Mattr or Trinsic if you need SD-JWT VC or mDoc for eIDAS 2 and EU wallet alignment. See Mattr vs Trinsic.

Bottom line

The lowest-friction way for an Entra shop to deploy verifiable credentials, with a genuinely useful account-recovery use case, held back by standards support that has not kept pace with where the EU wallet ecosystem is heading.

Microsoft Entra Verified ID: frequently asked questions

How much does Entra Verified ID cost?
Baseline protection covers up to 50,000 transactions per month at no cost, where a transaction is an issuance, a verification or a revocation. Above that threshold you need an Entra ID P1 or P2 subscription to continue, priced at 7 and 10 dollars per user per month paid yearly. Verified ID itself is included with any Entra ID subscription including the free tier, and Microsoft's own FAQ states there are no special licensing requirements to issue verifiable credentials. Microsoft does not publish an overage rate per transaction beyond the P1 or P2 requirement. Face Check is separate and priced differently.
How is Face Check billed, and what is the catch?
Face Check is either included as a full capability in Entra Suite, priced at 12 dollars per user per month on top of an existing P1, or bought pay-as-you-go billed to a linked Azure subscription. Enabling billing requires linking the Verified ID authority to an Azure subscription, with at least Contributor rights. The billing detail that catches people out is which failures still cost money. Microsoft's documented matrix is explicit: a request that fails after the QR code is read is not billed, and a Verified ID service error is not billed, but a face-matching processing failure is billed, and a returned face-match score is billed. So failed matches cost the same as successful ones. Microsoft does not publish a per-verification list price; figures circulating around 25 cents are not verifiable against a Microsoft page.
Which standards does Entra Verified ID implement?
Per Microsoft's standards documentation, last revised December 2024: W3C Verifiable Credentials Data Model version 1.1, credentials in JWT-VC format signed as JWS per RFC 7515, did:web as the only entity identifier method, Self-Issued OpenID Provider v2 for user authentication, OpenID for Verifiable Presentations, OpenID for Verifiable Credential Issuance draft 11, DIF Presentation Exchange 2.0.0, DIF Well Known DID Configuration for DID-to-domain trust, and W3C VC Status List for revocation. Supported signing keys are secp256k1, Ed25519 and EC P-256, with P-256 now the default.
Does Entra Verified ID support SD-JWT or mDoc?
No. Microsoft's standards page, FAQ and full what's-new changelog contain no mention of SD-JWT, SD-JWT VC, ISO/IEC 18013-5 mDoc or mDL, OpenID4VP draft 2x, DCQL, did:jwk or did:key. It implements Verifiable Credentials Data Model v1.1 rather than v2.0. This is a real standards-maturity gap against vendors aligned with the EU Digital Identity Wallet, which is built on SD-JWT VC and mDoc. If any comparison tells you Entra Verified ID does mDoc, it is wrong.
Has Microsoft deprecated Entra Verified ID?
No, the product is not deprecated. It has been generally available since August 2022, received feature work as recently as May 2026 when Entra ID account recovery with Verified ID reached general availability, and has active roadmap items. What was wound down is the ION DID method, which was preview-only and removed as a selectable trust system in December 2023, leaving did:web as the only option. Migrating off did:ion requires reissuing all credentials: exporting contract definitions, creating a new did:web authority through the Admin API, recreating credential definitions, updating issuer and verifier applications, then deleting the old authority.
What operational limits should I plan around?
Several are worth knowing before you design. Issuance requests are capped at 1 MB, a photo inside a credential at 1 MB, and callback results at 10 MB without a receipt. Non-FIPS-compliant P-256K signing keys retire on 1 July 2026, so affected authorities must upgrade. Opting out of Verified ID and back in issues your tenant a completely new DID, and Microsoft cannot recover the old one, so the domain must be relinked. Verified ID is supported on Microsoft GCC as of September 2025 but explicitly not on GCC High. The wallet is Microsoft Authenticator using the openid-vc protocol handler, with known Android limitations: QR scanning through the camera app fails on Android 9 and older, and work and personal profile separation breaks cross-profile scanning.
Who actually uses Entra Verified ID?
Microsoft publishes no credential issuance volume, tenant count or transaction figure, and we found no named customer references with published scale. LinkedIn workplace verification is a documented integration but carries no user numbers. The partner gallery was reorganised in October 2025 with deprecated individual partner pages removed, and 1Kosmos and CLEAR were added as identity verification partners in May 2026. Treat adoption claims with caution, since there is no public data to check them against.
What are the best Entra Verified ID alternatives?
For organisations already on Entra ID, the free 50,000 transaction allowance makes it hard to beat on cost. If you need SD-JWT VC or mDoc for EU Digital Identity Wallet alignment, look at Mattr, Trinsic or the credential platforms built for eIDAS 2, since Entra supports neither. For identity verification rather than credential issuance, the IDV specialists apply. If you want an open-source route, the decentralised identity tooling around DIDComm and the Hyperledger stack is the comparison set, though with far more assembly required.

More Decentralized Identity vendors

All Decentralized Identity →
Last reviewed By SWI Community TeamSuggest a correctionHow we research

By SWI Community Team · Last evaluated 2026-09-20

Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.