Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
TrustSink describes a plausible threat scenario, not a confirmed Microsoft Entra ID campaign. Microsoft documents a tenant-configured external MFA integration in which Entra redirects a user to a provider selected by the organization and validates the provider’s returned token. A rogue or compromised provider configuration would be a serious trust concern, but the available evidence does not establish that a campaign named TrustSink has occurred or that this integration, by itself, bypasses Entra’s validation or proves password theft.
What the TrustSink scenario means
External MFA lets an organization configure a provider outside Entra to supply an additional authentication interaction for users in scope. Entra still evaluates its policies and makes the access decision; the external provider participates in the authentication path.
The risk described by the TrustSink label is that an unauthorized or compromised provider could be configured as a trusted option. That is a reason to inspect the tenant’s configuration and administrative activity—not evidence that a named attack has been observed. Microsoft’s documentation describes the integration and its validation flow; it does not establish TrustSink as a real-world incident.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow external MFA works in Entra
- The user completes an initial factor. Entra handles the first sign-in factor.
- A policy calls for another factor. If the user can use the external MFA method, they may select it.
- Entra redirects the browser. The configured provider endpoint is discovered using the OIDC discovery URL associated with the provider.
- The provider performs its authentication interaction. It processes the request and redirects the user back with a token.
- Entra validates the response. Entra checks the token’s signature and required contents before accepting the external factor as satisfying MFA.
This flow makes the provider configuration security-sensitive: it determines which external service participates in an authentication decision. It does not, on its own, demonstrate that a provider can defeat Entra’s documented token checks, capture a password, replay a token, or maintain persistence.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Can a rogue external MFA provider steal a password?
A rogue or compromised provider is a plausible threat because it is involved in the user’s authentication path. But the available Microsoft documentation does not establish that a malicious provider can automatically obtain the password the user entered during the Entra sign-in, nor does it document a TrustSink exploit or confirmed victims. Treat password theft as an allegation to investigate, not a proven consequence of the integration.
Keep the claims separate: an unexpected provider entry is a configuration concern; proof of credential theft requires evidence from the relevant authentication, application, and administrative activity. Do not infer password capture or successful account compromise merely because the method is enabled.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
How to audit external MFA providers
- Review the Authentication methods policy. Identify external MFA methods, their enabled state and display names, and the included and excluded groups.
- Verify each provider’s identity. Confirm that its application ID, client ID, and OIDC discovery endpoint are expected and belong to the organization or an approved provider.
- Check application consent and permissions. Microsoft documents that consent is required. Missing consent, or an application that has been deleted or lost permission, can prevent the method from working.
- Investigate unapproved entries. If a provider is not authorized, disable or delete the method, then review related administrative changes and account activity under your incident-response process.
- Confirm the underlying configuration is addressed. A password reset alone does not remove or correct an unauthorized provider entry; check the tenant policy itself as part of remediation.
What to do if you find an unapproved provider
- Record the provider’s display name, application ID, client ID, discovery URL, enabled state, and group scope.
- Disable or delete the method if it is not approved, and verify the resulting configuration.
- Review administrative changes and related account activity to determine who changed the configuration and whether users or accounts were affected.
- Use your incident-response process to decide whether additional containment, credential resets, or user notifications are warranted. Base those steps on evidence of exposure or compromise, not on the provider entry alone.
Microsoft documents the ability to disable or delete the method and the configuration elements above. The investigation steps are practical security guidance, not a Microsoft-prescribed response to a confirmed TrustSink incident.
Would a FIDO security key solve this problem?
Microsoft lists external FIDO security keys among passwordless sign-in options. A FIDO2 security key can be considered as part of an organization’s authentication choices, but buying or deploying one does not remove a rogue external MFA provider from the tenant or reverse a compromised administrator account. Those require reviewing and correcting the tenant configuration and addressing any affected accounts.
Quick Recap
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
