Overview
You can integrate Persona identity verification with Microsoft Entra directly from the Microsoft Security Store. This article explains what the Security Store is and what Persona does there. It also tells how to subscribe, how to set up account recovery in Entra, and how to prepare your users.
What is the Microsoft Security Store?
The Microsoft Security Store is the Microsoft marketplace for security solutions. You find, subscribe to, and manage solutions from Microsoft and its partners in one location. You buy the subscription from Microsoft. Microsoft bills it to your Microsoft (Azure) account.
Persona is a Microsoft identity verification (IDV) partner. The Persona listing in the Security Store is Identity Verification by Persona.
What Persona does in the Security Store
You can use the Persona integration for features in Microsoft Entra that require identity verification. Today, the only such feature is self-service account recovery. Future Entra features that require identity verification will use this same subscription. Only Microsoft IDV partners can issue Verified IDs that Entra accepts for these features.
The integration works as follows:
- Microsoft Entra sends the user to Persona when a feature requires identity verification.
- The user takes photos of the front and back of their driver’s license or passport. Then the user takes a live selfie.
- Persona verifies the user. Then Persona issues a Microsoft-approved Entra Verified ID.
- Microsoft Entra uses the Verified ID to complete the action, for example to restore access to an account.
Plans in the Microsoft Security Store
The listing has two plans:
- Pay As You Go with Free Trial: This plan is for organizations that are new to Persona. The first 30 days are free. After the trial, the subscription continues. Microsoft bills your usage at the prices on the listing, for example for each Verified ID that Persona issues. Microsoft bills you through your Microsoft account. You do not need a Persona plan or a separate contract with Persona for this plan.
- Bring Your Own Organization: This plan is for organizations that already use Persona. You connect the subscription to your current Persona organization. Persona bills your usage through your current Persona agreement.
For the trial terms and the current prices, read the listing.
Before you start
Microsoft Entra account recovery has its own requirements. Make sure that your tenant meets them before you subscribe:
- A Microsoft Entra ID P1 license and a Face Check license. Read What license is required to use account recovery? in the Microsoft FAQ.
- Verified ID is enabled and Face Check is configured in your tenant.
- The administrator who sets up account recovery has at least the Authentication Administrator role in Microsoft Entra.
- The administrator who subscribes has the Contributor or Billing Administrator role for the Azure subscription that pays for the solution. You also select a resource group in that Azure subscription when you subscribe.
- The Temporary Access Pass method is enabled for the users who can recover their accounts. Account recovery gives each user a Temporary Access Pass at the end.
- Each user who can recover their account has the First name and Last name properties filled in on their Entra profile. These names must match the government ID of the user. Entra does not use the display name for this match.
Microsoft can change these requirements. The Microsoft list is in Enable and configure account recovery in Microsoft Entra ID.
How to set it up
You can start from the listing in the Microsoft Security Store. You can also start in the Microsoft Entra admin center: go to Entra ID > Account recovery, and select Select and subscribe to your first identity verification provider. Both paths open the same listing.
Subscribe with Pay As You Go
- Open the Identity Verification by Persona listing. Select Get Solution.
- Under Account details, select a Billing subscription and a Resource group. Enter a Resource name.
- Under Solution details, select Choose plan. Select Pay As You Go with Free Trial.
- Select Next. Make sure that the order details are correct. Then select Place order.
- When the subscription is ready, select Configure account now. The Persona activation page opens.
- Sign in with your Microsoft work account.
- Enter your contact details. Use the email address that you want to use to sign in to the Persona Dashboard.
- Activate the subscription.
Persona creates a Persona organization for you and sends an invitation to the email address that you entered. Use the invitation to set up your sign-in for the Persona Dashboard. Then go back to the Account recovery page in the Microsoft Entra admin center.
If the activation does not complete, read What do I do if the activation fails?.
Subscribe with Bring Your Own Organization
Use this plan to connect the subscription to a Persona organization that you already have. Bring Your Own Organization needs a Persona plan that includes this integration.
- Do steps 1 to 5 of Subscribe with Pay As You Go. In step 3, select Bring Your Own Organization.
- Sign in with your Microsoft work account.
- Under Connect your Persona organization, select Authorize. Sign in to Persona and approve the request. The page shows the name of your Persona organization.
- Activate the subscription.
To see the status of the subscription, go to Management > My Solutions in the Security Store. With this plan, Persona does not create a new organization or new Dashboard users. Your current users and settings stay as they are.
If the activation does not complete, the activation page shows a message. To find what to do, read What do I do if the activation fails?.
What you get with Pay As You Go
- A Persona organization. If you buy another subscription for the same Microsoft tenant, Persona uses the same organization.
- Access to the Persona Dashboard. You can see the verifications of your users and manage your Dashboard users.
- A verification flow that Persona manages. The flow asks the user for a driver’s license or a passport, front and back. Then it asks for a selfie, in which the user turns their head as the flow tells them. After the user passes both steps, Persona issues the Verified ID.
The user must complete the flow on a phone within 1 hour.
Set up account recovery in Microsoft Entra
After you subscribe, create an identity verification profile in Microsoft Entra. The profile tells Entra which users can recover their accounts and which provider verifies them. The steps below are a summary. The full Microsoft procedure is in Create an identity verification profile.
- Sign in to the Microsoft Entra admin center as at least an Authentication Administrator.
- Go to Entra ID > Account recovery. Select the Profiles tab, then select Add.
- Enter a Name for the profile and, if necessary, a Description. Select Next.
- Select a recovery mode, then select Next:
- Evaluation: The user does the identity verification and gets a Verified ID, but Entra does not recover the account. Use this mode for a pilot.
- Production: The user does the identity verification, and Entra recovers the account.
- On the Include tab, select the user group that can use this profile. Start with a small pilot group. Select Next.
- Select Identity Verification by Persona as the identity verification provider. Select Next.
- Select a Match confidence. Exact requires an exact match of the first and last name. Relaxed accepts some differences in how names appear on a government ID. Select Next.
- Make sure that the settings are correct. Then select Complete.
- Test the recovery with a user in the pilot group.
- When the test is successful, edit the profile and change the recovery mode to Production.
Conditional Access policies in your tenant can apply during account recovery. A policy that requires a compliant device, a trusted location, or multifactor authentication can stop the recovery. Test your policies with the pilot group before you add more users.
Prepare your users
During recovery, Persona adds a Verified ID to the Microsoft Authenticator app on the phone of the user. Thus, each user must have Microsoft Authenticator installed on their phone. Ask your users to install it before they need to recover an account. They do not have to sign in to Authenticator to store the Verified ID.
You can send your users a message like this:
Please install the Microsoft Authenticator app on your phone from the App Store or Google Play.
If you lose access to your work account, you can use your phone to recover it.
To recover your account, you need your phone and your driver's license or passport.What users see during recovery
- The user tries to sign in to a Microsoft application, or goes to login.microsoftonline.com.
- The user selects Other ways to sign in, then Recover your account.
- Entra shows information about account recovery. Then Entra sends the user to Persona.
- On their phone, the user takes photos of the front and back of their driver’s license or passport.
- The user takes a selfie and turns their head as the flow tells them.
- Persona issues a Verified ID. The user adds it to Microsoft Authenticator.
- Microsoft Authenticator asks the user to complete a Face Check.
- Entra gives the user a Temporary Access Pass. The user copies it and selects Sign in.
- Entra opens Security info. The user registers a new sign-in method, for example a passkey.
If the user does not complete the Persona flow within 1 hour, the link expires. The user must start the recovery again. For the Microsoft description of these steps and for troubleshooting, read Perform account recovery in Microsoft Entra ID.
FAQ
When should I use this instead of the other Persona Entra solutions?
There are two reasons to use the Security Store solution:
- You need it for Entra platform features that require identity verification. Entra accepts Verified IDs for these features only from Microsoft IDV partners through the Security Store. Today, the only such feature is self-service account recovery. More features will come in the future. If you are already a Persona customer, you must also connect through the Security Store solution to use these features. Select Bring Your Own Organization to connect your current Persona organization.
- It can be simpler to buy through Microsoft if you use Entra but not Persona. With Pay As You Go, you subscribe, pay, and manage the subscription through Microsoft. You do not sign a separate contract with Persona or get a separate bill from Persona.
You can also buy Persona directly and build the Entra integrations yourself. For example, you can issue Entra Verified ID credentials from your own Entra tenant, or add Persona as an external authentication method. These integrations use your Persona agreement and your own configuration. Read the Microsoft Entra integration overview, Configure Persona with Microsoft Entra Verified ID, and Configure Persona as an authentication method in Microsoft Entra.
What do I do if the activation fails?
If the activation does not complete, the Persona activation page shows a message. Find the message in the tables below. Then do the step in the same row.
These messages can occur with Pay As You Go and with Bring Your Own Organization:
| Message | What to do |
|---|---|
| ”Persona is temporarily unavailable.” | Wait a few minutes. Then select Activate subscription again. |
| ”Persona could not complete this activation.” | Try again. If the problem continues, contact Persona support. |
| ”This subscription is already being activated.” | Wait 1 minute. Then refresh the page, or open your subscriptions to see the status. |
| ”This subscription is already connected to a Persona organization.” | You do not have to activate it again. Open your subscriptions to see the status. |
| ”This subscription is not in a state that can be provisioned.” or “This subscription cannot be activated while it is …” | If you unsubscribed, reactivate the subscription in the Security Store. Then try again. |
| ”Open a valid Microsoft Marketplace activation link first.” or “This link has expired.” | Go back to the Security Store. Open your subscription and select Configure account now again. |
These messages occur only with Bring Your Own Organization:
| Message | What to do |
|---|---|
| ”Your Persona organization is not on a paid Persona plan.” | Contact your Persona account team, or subscribe with Pay As You Go. |
| ”Your organization’s Persona plan does not include this integration.” | Contact your Persona account team to add the integration to your plan. |
| ”Your Persona organization is not active.” | Contact Persona support, or ask an administrator of your Persona organization to make it active again. |
| ”The connected Persona organization has no active production environment.” | Activate a production environment in the Persona Dashboard. Then try again. |
| ”That environment ID is not a production environment in the connected Persona organization.” | Make sure that the Environment ID is correct, or leave the field blank. |
| ”That inquiry template is not deployed to the production environment of the connected Persona organization.” | Deploy the template in the Persona Dashboard, or leave the Inquiry Template ID blank. |
| ”That inquiry template was not found in the connected Persona organization.” | Make sure that the Inquiry Template ID is correct, or leave the field blank. |
| ”Connecting requires permission to manage API keys in your Persona organization.” | Ask an administrator of your Persona organization to select Authorize, or to give you that permission. |
| ”Persona did not receive all of the access it needs.” | Select Authorize again. Approve all of the access that Persona requests. |
| ”Your Persona authorization has expired or is no longer valid.” | Select Authorize to connect your Persona organization again. |
| ”This Microsoft tenant is already associated with another Persona organization.” | Authorize that organization instead, or contact Persona support. |
| ”This organization was created by a Security Store subscription and cannot be connected again.” | Authorize a different Persona organization, or contact Persona support. |
Who owns the data?
Your organization owns and controls its verification data. Persona does not sell the data of any person. For more information, read the Security and Privacy Overview.
What happens when I cancel the subscription?
When a subscription is suspended or cancelled in Microsoft, your users cannot verify through it. With Bring Your Own Organization, your Persona organization stays as it is.
Where can users verify?
Users verify on a phone. The flow accepts a driver’s license or a passport.
Who do I contact for help?
If you need further assistance, reach out to our support team.
Plans Explained
Microsoft Entra Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| Microsoft Entra Integration | Not Available | Not Available | Limited | Available |