Arup reimagines identity security using Face Check with Microsoft Entra Verified ID

Creating beauty and future-first built solutions 

Arup is the creative force behind such iconic structures as the Sydney Opera House and Barcelona’s La Sagrada Família church, a gloriously convoluted Gaudí design to which Arup contributed critical expertise. The global consultancy also delivers crucial infrastructure, from airports to metro systems, and from water utilities to wind farms. With a reputation for excellence and for its future-focused impact, the engineering and design leader has much to protect. Its IP is a priceless asset, as are its high-volume, high-value financial transactions. Realizing the insidious potential of deepfake impersonation in the fast-evolving cyberthreat landscape, Arup sought an identity solution for today—and for tomorrow. 

Turning to Microsoft for cutting-edge identity authentication

Given what’s at stake for Arup, it’s not surprising that the company’s Secure Score in Microsoft Defender XDR is in the top tier. But the company required additional assurance to protect itself from deepfake impersonations—videos, pictures, or audio clips created with AI from a 10-second clip. AI technology can provide an invaluable service for people who have medical conditions that make it difficult to speak and want to be able to formulate answers in their own voice. But in the wrong hands, it can become highly effective tool for committing theft or fraud.

Face Check with Microsoft Entra Verified ID provided the sophisticated verification that the company needed. “Hearing about Face Check with Microsoft Entra Verified ID was a light bulb moment. We need technology that can quickly give us confidence that we’re interacting with who we think we are,” says Mark Prior, Global Identity & Access Management Service Owner at Arup.

Building an end-to-end identity verification service with the Entra suite

Having long trusted Microsoft Security solutions and Microsoft Entra solutions for access and identity management, Arup based its Arup Identity Verification Service completely on Microsoft technologies, with Microsoft Entra ID and Azure services on the back end. Arup developers introduced Face Check with Entra Verified ID on the front end to help prevent deepfakes. “The integration of Face Check with Entra ID and the rest of Microsoft Security stack is absolutely critical and underpins the success of our identity service,” says Chris Lyth, Global Chief Information Security Officer at Arup.

Arup piloted Face Check technology at the company’s Help Desk. Employees register a photo of themselves from an official identification document, currently Arup-held Microsoft 365 images. (The use of government-issued IDs is planned for the next iteration of the platform.) When they need a password reset, for example, the Help Desk requests that they submit a real-time selfie. Face Check, fueled by Azure AI services, then matches it against the photo on file. Because no sensitive personal information is shared—only the match results—user privacy is safeguarded.

Development teams also appreciate the interoperability with services such as Azure App Service for secure development. “The combination of Microsoft solutions, like Face Check and Azure API services, was key to successfully building and scaling our Arup Identity Verification Service. It interoperates with other Arup business processes, providing Face biometric verification across our environment,” explains Dipali Saija, Senior Software Developer at Arup. Her team used several Verified ID APIs in Face Check and the Web Apps feature of Azure App Service to create the solution.

Facing the future with confidence

By using Entra ID capabilities like Conditional Access policies in concert with Face Check, Saija’s team created the Arup Identity Verification Service to flex to many situations. It can grant very granular access to confidential resources—invaluable to people who hold the purse strings, like Stacey Robinson, Procurement Manager at Arup. Her department piloted the technology for credit card purchases. “With Face Check, we can proactively verify that anyone wanting to make a purchase is genuine and authorized,” says Robinson. “It compensates for the extra step it introduces with invaluable assurance. Furthermore, the technology has been straightforward to deploy.” Adds Prior: “Not only does Face Check provide high assurance for high-risk/high-value transactions; we can adapt it to retain that high-confidence biometric assurance for quality and audit purposes, no matter whether it’s a remote or face-to-face transaction.”

For Lyth, upgrading an already stellar security posture is key. “Thanks to the seamlessness of the solution, we’re seeing tremendous uptake,” he concludes. “We’re using Face Check to deepen our layers of defense, giving us the control and confidence we need to embed the culture of security that will position us for a more secure future.”

Discover more about Arup on Facebook, Instagram, LinkedIn, X/Twitter, and YouTube.