The password is typed
Someone enters their domain password on the Windows logon screen, into EndpointTrust's own credential tile.
Windows sign-in MFA
A password alone should not unlock a company laptop.
EndpointTrust puts a one-time code between an Active Directory password and the Windows desktop — at the console and over RDP. The code is checked by this service, not by the machine, so a computer on its own cannot be talked into letting somebody in.
No credit card to look around. Deploys with Group Policy. One signed MSI.
AN
Alice Nguyen
CONTOSO\alice
Code sent to +44 ••• •••21Console·RDP·Unlock
2Paths covered: console and RDP
4Windows releases: 11, Server 2019/2022/2025
1Signed installer, for every customer
0Lines of client JavaScript in this console
How a sign-in works
Four steps, and the password never leaves the machine.
EndpointTrust is not in the password path. Windows validates the password, exactly as it does today. What EndpointTrust decides is whether the attempt gets that far.
EndpointTrust is asked
The tile asks this service whether that account needs a second factor, and gets back a signed decision bound to that machine and that session.
A code is sent
To the number your organisation registered for that person. The message carries your name and the code, and nothing else — an SMS is readable on a lock screen.
Windows gets the password
Only after this service has verified the code and signed the result does the tile hand the credential to Windows. Which then validates the password itself.
What you get
Built around one question: who is actually at the keyboard?
Everything here exists to make that answer hard to forge, and to make it obvious when it could not be answered at all.
A machine cannot redirect its own code
The sign-in request has no field for a destination. EndpointTrust reads the number from your records, where exactly one live number per person is enforced by the database itself.
Every decision is signed
Policies, decisions and grants are ES256 documents signed with your organisation's own key. The agent holds only your public key, so a licence for one tenant is unusable at another.
Your SMS provider, or ours
Use the managed sender, or bring Twilio, Vonage, or any gateway of your own — and send a real test message before anybody's sign-in depends on it.
One installer, deployed by Group Policy
The MSI is the same file for every customer and is signed once, so there is a single hash you can verify. What makes an installation yours is a 4 KB configuration bundle.
The numbers that matter are first
Every sign-in that did not use a code is counted and shown prominently: grace, local recovery, pass-through, and paths with no coverage at all.
Onboard by CSV, not by connector
There is no directory connector, deliberately — one that can read your directory can be made to write your phone numbers. Import the list you already have.
Honest scope
The list of what this does not do is part of the product.
A credential provider is not a session monitor, and Windows has more than one way in. Both facts are written into the software: coverage is reported per machine, and a sign-in whose outcome was never observed is reported as unknown rather than quietly counted as a success.
What it covers
- Windows 11 and Server 2019, 2022, 2025 — x64
- Console sign-in and console unlock
- RDP sign-in and RDP unlock
- Active Directory password, then a code by SMS
- A bounded, auditable password-only window when this service is unreachable
- Per-machine coverage reporting and a full activity export
What it does not
- No mobile app, no push, no QR, no TOTP
- No macOS, no Linux, no web gateway, no SSH
- No device posture, no risk scoring, no TPM attestation
- No auto-updater and no background service on the endpoint
- No directory connector
- It cannot block the RDP network-level authentication exchange — no target-side MFA can
- It cannot see logoffs, so there is no “who is signed in right now”
“Grace is password-only authorisation. It is never an offline code check, and it never counts as a verified second factor.”
— from the policy a licence carries. When a machine cannot reach this service, a signed grant can let a sign-in through on the password alone, bounded in time and in number of uses. Every one of those is counted and shown on your overview. You choose the window, or switch it off entirely.
Plans
Per computer, monthly or yearly.
Every plan includes the managed SMS sender and lets you bring your own instead. One seat is one computer.
Pilot
1–25 computers
For proving it works on a handful of machines before you commit. PLACEHOLDER pricing.
- windows
- 6-digit codes
- No password-only window
- Managed SMS, or bring your own
Team
10–250 computers
Up to 250 computers, with a short password-only window if this service is unreachable. PLACEHOLDER pricing and PLACEHOLDER grace policy.
- windows
- 6-digit codes
- 4 h password-only window if unreachable
- Managed SMS, or bring your own
Estate
100–10000 computers
For a whole domain. Same controls, higher seat ceiling, and a longer offline window for sites with unreliable links. PLACEHOLDER pricing and PLACEHOLDER grace policy.
- windows
- 6-digit codes
- 12 h password-only window if unreachable
- Managed SMS, or bring your own
Prices on this deployment are placeholders pending commercial sign-off.
Questions
The ones that get asked first.
Does EndpointTrust see our passwords?
No. The credential provider hands the password to Windows, which validates it. EndpointTrust decides whether a second factor is required and verifies the code. No password is ever sent to, logged by, or stored by this service.
What happens if your service is down?
Whatever your policy says. You can refuse every sign-in, or allow a bounded password-only window with a signed grant — so many uses, for so many hours. Every use of it is counted and reported. A provider outage is deliberately not a reason to let a password through on its own; only an inability to reach this service is.
Can somebody bypass it by picking another sign-in option?
The agent suppresses the credential providers it recognises on the paths it covers, and reports honestly when it cannot. Each machine's coverage is shown in the console as enforced, alternate-paths-allowed, or unprotected. It does not claim to have closed a door it cannot close.
Who registers the phone numbers?
You do, by default — and that default is what makes it impossible for a compromised machine to redirect a code. You can optionally let a computer propose a number for an account that has none, with or without your approval. The trade-off is documented in full rather than buried in a toggle.
How does it get installed on hundreds of machines?
Group Policy, as an assigned package, with the MSI and your configuration bundle on a share. Activation runs once per machine with a short-lived enrollment credential that the tool overwrites and deletes after use.
Is there a mobile app?
No. SMS to a registered number is the whole second factor in this version. If you need push or TOTP, this is not the product yet, and we would rather say so now.
Put a second factor on your Windows logon screens.
Create an account, register one person, install the agent on one machine, and see a real code arrive. Then decide.
Create an account