Request a demo →
Use Rainbow Secure Human-Verified MFA as a federated authentication layer for selected or all users. Keep Microsoft Entra for identities, Conditional Access and authorization while adding stronger protection against stolen credentials, phishing automation and push fatigue.
Microsoft Entra is powerful infrastructure for users, applications, Conditional Access and cloud authorization. Rainbow Secure is designed to complement that investment—not force customers to rebuild it.
The opportunity appears when organizations want stronger human verification, less dependence on push or personal devices, a phased path for specific groups, or identity controls that extend beyond a single MFA prompt.
rSecureKey adds patented multidimensional verification to the federated Microsoft sign-in. It evaluates the user’s text together with approved color, style, font, formatting placement and contextual dimensions—making stolen credential text only one incomplete part of the authentication response.
Attackers test stolen or repeatedly guessed passwords against Microsoft sign-in. rSecureKey adds approved color, style, font and formatting-placement dimensions, so matching the text alone does not reproduce the complete response.
Malware may capture what a user types. rSecureKey can require a dynamic visual instruction and an exact interaction that is not represented by captured keystrokes alone.
A convincing page may collect a password or one-time code. Rainbow Secure verifies an additional multidimensional response before returning the federated authentication result to Entra.
AiTM proxies attempt to relay sign-in traffic or steal authenticated sessions. rSecureKey reduces reliance on reusable credential text, while device, location, time and behavior policies can add scrutiny.
Repeated push prompts can pressure users into approving access. Rainbow Secure does not use push approval; the user must complete the configured Human-Verified interaction.
Administrative, functional or team credentials can be copied or passed between people. rSecureKey strengthens the login, while controlled team access and activity evidence help restore individual accountability.
Rainbow Secure reduces exposure to these attack paths; it does not replace endpoint protection, secure session design, Conditional Access, monitoring or incident response.
Free or included MFA can be a reasonable baseline. Rainbow Secure is for organizations and user groups that need a different level of protection, flexibility or visibility.
Rainbow Secure can verify text, color, font, style and where formatting is applied—making captured credential text only one part of the answer.
Rainbow Secure does not use push approval. Attackers cannot simply generate repeated approval prompts until a user accepts.
Device-less and multi-channel choices can support users who share workstations, cannot use personal phones or need a different verification path.
Add team access, lifecycle governance, access evidence and risk-aware policies instead of treating MFA as an isolated prompt.
Use a custom federated domain or subdomain to begin with selected users while other groups continue using their existing Microsoft authentication experience.
A verified custom domain is configured for federation. When a user signs in with a UPN in that federated domain, Microsoft redirects authentication to Rainbow Secure. After successful Human-Verified authentication, the SAML response returns the user to Entra and the requested Microsoft resource.
Design requirement: Microsoft’s default onmicrosoft.com domain cannot be federated. The production design uses a verified custom domain and must align the UPN, issuer, claims and target tenant.
The sign-in identifier determines the user’s Entra domain.
Rainbow Secure performs the configured multidimensional and contextual verification.
Entra validates the federation response and identifies the user.
Conditional Access, resource authorization and session policies continue in Microsoft.
Move the selected production custom domain to Rainbow Secure federation so users in that domain authenticate through Rainbow Secure before accessing Microsoft resources.
Create and verify a dedicated subdomain for the users adopting Rainbow Secure. Their UPN uses the federated subdomain, while their normal email address can remain available as an alias. Other users remain on a managed Microsoft domain.
For selected groups or resources, Conditional Access can still require a Microsoft authentication strength after Rainbow Secure federation. This creates two checkpoints when the policy requires both.
The best pilot is important enough to matter, small enough to govern and clear enough to measure.
Protect daily privileged administrators whose accounts can change policies, identities, subscriptions and cloud resources.
Make a stolen password less useful before it reaches Exchange Online, Teams, SharePoint or other Microsoft 365 services.
Replace loosely shared credentials with controlled team access and clearer individual accountability.
Begin with executives, finance, IT, contractors or other groups exposed to phishing and credential theft.
Support operational teams that cannot rely on a personal phone or hardware token at every sign-in.
Many organizations begin with Entra and Microsoft 365, then adopt Google Workspace or Google Cloud, Salesforce, Oracle and other business platforms. Rainbow Secure can provide a coordinated identity-security and access-management layer across compatible environments—helping teams avoid separate login policies, disconnected user access and inconsistent evidence for every new cloud service.
For customer-facing or workforce .NET applications running in the cloud, the Rainbow Secure SDK can add advanced authentication and user-verification capabilities directly to the application journey. This gives development teams a consistent security foundation without treating every custom application as a separate identity island.
Explore custom application integration →Map sign-in, onboarding, privileged actions or other sensitive user events.
Connect the application to the approved authentication or verification flow.
Use the agreed identity controls and maintain reviewable authentication activity.
Rainbow Secure is well suited for daily cloud administrators and controlled high-risk access. However, Microsoft recommends separate cloud-only emergency-access accounts for tenant recovery. At least one recovery path should remain independent of the same federation service so an outage or federation error does not lock the organization out.
A Microsoft security consultation should define which administrator accounts use Rainbow Secure, which emergency accounts remain independent, how credentials are controlled, and how every emergency use is alerted and reviewed.
Add a user interaction that a captured password or OTP does not fully represent.
Start with a custom federated subdomain, selected groups and high-value workflows.
Keep Entra Conditional Access, resource authorization and Microsoft application governance.
Use Rainbow Secure, Microsoft MFA or both according to user group and resource policy.
No. In this design, Entra remains the Microsoft identity and authorization platform. Rainbow Secure provides federated Human-Verified authentication and related identity-security controls.
Yes. A dedicated verified and federated subdomain can provide a phased user population while other users remain on a managed Microsoft domain. UPN, email alias, claims and application compatibility must be validated.
Yes. Some groups may remain entirely on Microsoft authentication. For others, Entra Conditional Access may require an additional approved Microsoft method after Rainbow Secure authentication.
Yes, where the target platform supports the required integration. Rainbow Secure can help coordinate authentication, access management and evidence across compatible Microsoft and non-Microsoft environments. Each connection and responsibility is validated during technical discovery.
Yes. Development teams can use the Rainbow Secure SDK and supported integration patterns to add advanced login security or user verification to a custom .NET application. The exact flow, claims, authorization boundary and recovery behavior are confirmed during solution design.
No. Microsoft recommends independent cloud-only emergency-access accounts. Do not make every recovery path dependent on the same external federation service.
Measure successful sign-in, user completion, administrator effort, Conditional Access behavior, application compatibility, recovery procedures and the agreed security outcome.
Bring your Entra tenant model, custom domains, target users, Conditional Access policies and priority resources. We will map a safe pilot and show both the user and administrator experience.
Microsoft, Microsoft 365, Azure, Entra and Microsoft Authenticator are trademarks of Microsoft. Rainbow Secure is an independent identity-security provider and Microsoft ISV partner. Final capabilities depend on Microsoft licensing, tenant configuration, supported protocols and the approved deployment design.