SenseCrypt vs Microsoft Entra ID

The match runs on the device

Capture and face matching happen on the user's own device. The server keeps no face image and no face template, so there is no face gallery to breach, subpoena, or migrate later.

One token, one sign-in

Each sign-in spends a single-use face token, and that token is dead once it is used. A copy captured in transit is worth nothing, and the tokenization is patent-pending.

No code to read out

A one-time PIN appears once in the whole lifecycle, when a user binds a new device. It is emailed, and also sent by SMS when a mobile number is on file. Sign-in itself uses no password and no shared code, which is why it resists phishing.

Liveness is certified, recognition is evaluated

Liveness holds iBeta ISO 30107-3 certification at Level 1 and Level 2. That covers presentation attacks at the camera, such as a printed photo or a mask; app attestation and device authenticity checks block virtual-camera and SDK injection. Face recognition entered the NIST evaluation in 2021, then FRVT and later split into FRTE and FATE, and we maintain it through our latest submissions.

Entra ID holds the Microsoft estate

It is Microsoft's cloud identity platform for workforce and customer identity, it speaks the open standards, and it is already wired into the products your users open every morning. Leaving it is rarely a sign-in decision alone.

SenseCrypt is narrow on purpose

One sign-in method, hardened, with no password path left behind it to weaken the result. That is a strength when phishing is your real risk, and a constraint when it is not.

The protocol layer is common ground

SenseCrypt speaks OIDC and OAuth 2.0 with PKCE and pushed authorization requests, SAML 2.0, and SCIM 2.0 for provisioning. It also supports CIBA, where the backchannel push starts a device-bound face ceremony rather than a tap to approve.

Roles are emitted, not enforced for you

SenseCrypt puts roles and permissions in the token, and your application decides what they allow. SenseCrypt itself runs a default-closed group gate at sign-in and capability checks on the admin console routes, with multi-tenant isolation and audit logs underneath.

Priced per user, with named add-ons

One dollar per user per month with a 20-seat minimum, and that is the list price rather than the whole bill. Non-exportable signing-key custody adds twenty dollars per key per month, and each tenant or custom domain past the three included costs ten dollars per month. Customer identities bill as monthly active users. The 30-day trial takes no card.

Entra ID keeps the directory

Your applications keep pointing at Entra ID, and user records, group membership and policy stay where they are. Nothing in your existing application integration has to be rewritten.

SenseCrypt becomes the proof step

Entra ID hands the user to SenseCrypt over SAML, or over OIDC where your configuration supports it. The face ceremony runs on the device, SenseCrypt returns a standard assertion or token, and Entra ID issues the session as it always did.

Start with one group

Federation is set up as a connection, so you can route a pilot group or a single application through face login and leave everyone else on the current method. Widen it when the helpdesk queue tells you it holds.