News

Microsoft Previews Face Check Verifications Using Entra Verified ID

• By Kurt Mackie
• 02/06/2024

Microsoft on Tuesday announced a preview of Face Check in Microsoft Entra Verified ID, providing a means for organizations to verify the identities of individuals.

Face Check is described by Microsoft as a "facial verification" technology. It's not the same thing as "facial recognition" technology, which is associated with surveillance cameras used by police or government agencies, Microsoft argued, in this document:  

Facial verification is a consent-based process for proving a person is who they claim to be. Facial recognition tools are controversial and are used for surveillance and investigation without a person's knowledge by government agencies.

Face Check, now at preview, has been tested. Microsoft's announcement pointed to help desk services provider BEMO, which used Face Check to thwart possible employee impersonations, which could arise when granting administrative credentials.

How Face Check Works
The verification process with Face Check will compare a person's "real-time selfie" photo with their Verified ID, which may be tied to that person's driver's license or passport photo. The real-time selfie undergoes a "liveliness" check so that no one can substitute a static two-dimensional photo of a person during the verification process. Microsoft claims that the liveliness check is capable of detecting "a wide variety of spoofing techniques."

The Face Check service just uses parts of a face, such as eyes and nose positions, rather than the whole face, to derive a "confidence score" that the two photos are a match. It uses "the same default confidence matching threshold as Windows Hello," which is Microsoft's biometric authentication scheme on devices, Microsoft explained in this FAQ document (PDF download).

The confidence score delivered by Face Check is expressed as a percentage. It defaults to 70 percent for a match, but it can be set as low as 50 percent. A high confidence score for a match would fall into the 80 percent to 90 percent range. The Face Check service just transmits to organizations whether the selfie photo had a passing confidence score. No other information gets transmitted, including the photo.

Face Check uses the Azure AI Vision Face API for "face detection, face recognition, face match, and liveness check." It was trained using face clips of about 5,490 study participants across various gender and "ancestry groups," Microsoft explained, in this "fairness assessment" document.

Microsoft Entra Verified ID
Verified ID is Microsoft Entra technology that was commercially released more than a year ago. It uses a decentralized blockchain electronic ledger to allow individuals to submit their identity information, as well as revoke it. It's the person who has possession of the cryptographic key under the Verified ID scheme.

The storage and presentation of Verified IDs happens via so-called "digital wallets," which can be the Microsoft Authenticator app. Alternatively, a digital wallet can be created using Microsoft's Wallet SDK. Microsoft claims that Verified ID was built on "open standards" and that it "can work with identity verification systems that other businesses or developers may create in the future," per this whitepaper (PDF download).

Partnerships
Microsoft suggested that Face Check can serve as added check to the identity services provided by companies such as "LexisNexis Risk Solutions, Au10tix, and IDEMIA." Microsoft also is planning to bolster its API in partnership with "Dun & Bradstreet (DNB), LexisNexis Risk Solutions, and IDEMIA," incorporating aspects such as "verified work history and legal entity verification."

Face Check is currently free to use as a preview release. Microsoft is planning to charge "$0.25 per transaction" at a later point, per Microsoft's FAQ. The billing models will be announced "later in the year."