---
title: "Step-Up Authentication — Identity Glossary | IDSync"
description: "Step-up authentication prompts a user who is already signed in for an additional, stronger factor before allowing a sensitive action — like transferring…"
lang: en
json-ld: |
  [
    {
      "@context": "https://schema.org",
      "@type": "BreadcrumbList",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://idsync.com/"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Glossary",
          "item": "https://idsync.com/glossary"
        },
        {
          "@type": "ListItem",
          "position": 3,
          "name": "Step-Up Authentication",
          "item": "https://idsync.com/glossary/step-up-authentication"
        }
      ]
    },
    {
      "@context": "https://schema.org",
      "@type": "DefinedTerm",
      "@id": "https://idsync.com/glossary/step-up-authentication",
      "name": "Step-Up Authentication",
      "alternateName": [
        "step-up auth",
        "transaction authentication"
      ],
      "description": "Step-up authentication prompts a user who is already signed in for an additional, stronger factor before allowing a sensitive action — like transferring money, changing payout details, or accessing PII.",
      "url": "https://idsync.com/glossary/step-up-authentication",
      "inDefinedTermSet": "https://idsync.com/glossary"
    },
    {
      "@context": "https://schema.org",
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "How is step-up different from re-authentication?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Re-authentication forces any factor again. Step-up specifically requires a *higher* assurance level than what the session currently holds."
          }
        },
        {
          "@type": "Question",
          "name": "Does step-up work with SSO?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Yes. The relying party sends `acr_values` (or vendor-specific equivalents) to the IdP, which re-prompts and returns updated assurance claims."
          }
        },
        {
          "@type": "Question",
          "name": "What's the right step-up factor in 2026?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "A phishing-resistant factor — passkey or hardware security key. SMS and TOTP no longer meet the bar for high-value actions."
          }
        }
      ]
    }
  ]
---

[![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/)

[Directory](/directory)

[Compare](/compare)

[Resources](/resources)

[Browse tools](/directory)[Run Stack Finder](/stack-finder)

1.  [Home](/)
2.  [Glossary](/glossary)
3.  Step-Up Authentication 

Authentication

# Step-Up Authentication

Step-up authentication prompts a user who is already signed in for an additional, stronger factor before allowing a sensitive action — like transferring money, changing payout details, or accessing PII.

Last reviewed 3 months ago

Key points

-   Triggered by action sensitivity, not just login
-   Usually requires a phishing-resistant factor (passkey, WebAuthn, hardware key)
-   Implemented via OIDC acr\_values / amr claims or vendor risk APIs
-   Different from MFA at login — it happens mid-session
-   Core to PSD2 Strong Customer Authentication and high-assurance workflows

## What it is

Step-up authentication is a control that asks an already-authenticated user to re-verify identity with a stronger factor before performing a high-risk action. The user is not logged out; the session is upgraded.

Classic examples: a banking app prompts for a passkey before a wire transfer, an admin console requires a hardware key before deleting a tenant, a payroll system asks for re-authentication before changing bank details.

## How it works

The relying party signals required assurance using OIDC `acr_values` (Authentication Context Class Reference) or `max_age`. The IdP enforces the policy — for example, prompting for WebAuthn if the existing session only used password+TOTP — and returns an updated ID token with new `amr` (Authentication Methods References) and `auth_time` claims. The app inspects those claims before authorizing the action.

## When buyers care

-   Fintech, payments, and crypto products subject to SCA / PSD2
-   SaaS admin actions (tenant deletion, billing changes, role grants)
-   Healthcare and HR systems accessing sensitive records
-   B2B platforms where compromised sessions are the dominant attack path

## Common misconceptions

-   **Step-up is not the same as MFA.** MFA happens at login; step-up happens mid-session, per action.
-   **More prompts is not better.** Step-up should be reserved for genuinely sensitive actions or risk signals — over-prompting trains users to click through.
-   **Re-entering a password is not step-up.** A real step-up uses a stronger factor than the current session has.

## FAQ

### How is step-up different from re-authentication?

Re-authentication forces any factor again. Step-up specifically requires a _higher_ assurance level than what the session currently holds.

### Does step-up work with SSO?

Yes. The relying party sends `acr_values` (or vendor-specific equivalents) to the IdP, which re-prompts and returns updated assurance claims.

### What's the right step-up factor in 2026?

A phishing-resistant factor — passkey or hardware security key. SMS and TOTP no longer meet the bar for high-value actions.

IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about).

### One identity concept, explained per issue

Get vendor-neutral identity explainers and market updates in your inbox.

Work email\* 

Name

Company

Role (optional)

Interests (optional)

Pick what you want more of.

IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents

Subscribe

Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time.

### Vendor categories

[sso](/directory/category/sso)[mfa](/directory/category/mfa)[passwordless authentication](/directory/category/passwordless-authentication)

### Vendors to evaluate

[okta](/directory/okta)[auth0](/directory/auth0)[microsoft entra](/directory/microsoft-entra)

### Not sure which tool you need?

Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack.

[Run the Stack Finder](/stack-finder)

### Explore tools for this topic

Browse vetted vendors in the sso category.

[Explore tools](/directory/category/sso)

[![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/)

The buyer-focused platform for identity, access, and authentication software.

#### Platform

-   [Home](/)
-   [IAM Stack Finder](/stack-finder)
-   [Directory](/directory)
-   [Resources](/resources)
-   [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026)
-   [Buyer Guides](/guides)
-   [Glossary](/glossary)
-   [Newsletter](/newsletter)
-   [Newsletter Archive](/newsletter/archive)

#### Best of guides

-   [All comparisons](/compare)
-   [All vendor alternatives](/alternatives)
-   [Best SSO tools](/compare/best-sso-tools)
-   [Best MFA tools](/compare/best-mfa-tools)
-   [Best PAM tools](/compare/best-pam-tools)
-   [Best IGA tools](/compare/best-iga-tools)
-   [Best CIAM tools](/compare/best-ciam-tools)
-   [Best passwordless auth](/compare/best-passwordless-authentication-tools)
-   [Best identity security](/compare/best-identity-security-tools)
-   [Best machine identity](/compare/best-machine-identity-tools)
-   [Best SaaS access governance](/compare/best-saas-access-governance-tools)
-   [Best developer auth](/compare/best-developer-authentication-tools)
-   [Best for startups](/compare/best-iam-tools-for-startups)
-   [Best for enterprises](/compare/best-iam-tools-for-enterprises)
-   [Best SCIM tools](/compare/best-scim-provisioning-tools)
-   [Best for AI agents](/compare/best-ai-agent-identity-tools)
-   [Best NHI tools](/compare/best-nhi-management-tools)
-   [Okta pricing explained](/guides/okta-pricing)
-   [Auth0 pricing explained](/guides/auth0-pricing)
-   [Okta alternatives](/alternatives/okta)
-   [Auth0 alternatives](/alternatives/auth0)

#### For Vendors

-   [Sponsor](/sponsor)
-   [Badges](/badges)
-   [Submit Product](/submit-product)
-   [Claim Profile](/claim-profile)
-   [Partner](/partner)

#### Company

-   [About & Methodology](/about)
-   [Contact](/contact)
-   [Privacy](/privacy)

Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only.

IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation).

© 2026 IDSync. All rights reserved.

Editorial independence. Sponsored placements are clearly disclosed.