External Authentication Method (EAM) is an Entra feature that lets a third-party service participate in multi-factor authentication. Instead of using only built-in methods such as a code app or hardware key, Entra can send the MFA step to an external provider and accept its response as part of the sign-in decision.
This matters because EAM expands the trust boundary around identity. If an attacker gains a privileged role, such as Authentication Policy Administrator or Global Administrator, they may be able to add or change an external MFA provider and make it look legitimate for selected users. In attacks, that can create a convincing sign-in flow that helps steal credentials or redirect authentication through attacker-controlled infrastructure. In defense, organizations should treat EAM onboarding as a sensitive control change: review admin-role assignments, monitor application registrations and service principals tied to MFA, and alert on any unexpected authentication policy updates.