Arup needed to protect highly valuable intellectual property and large, high-value financial transactions across a global business that designs and delivers complex infrastructure and iconic buildings. Even though Arup already had a top-tier Secure Score in Microsoft Defender XDR, the team saw new risks emerging from AI-driven threats, especially deepfake impersonations created from short video or audio clips. These could be used to authorize fraudulent payments, access confidential designs, or compromise internal systems. To stay ahead of these fast-evolving threats, Arup decided it needed an identity solution that could:

• Provide higher assurance that people are who they claim to be, especially for sensitive actions like password resets and financial approvals.
• Preserve user privacy by sharing only verification results, not raw biometric data.
• Fit into existing Microsoft-based security and identity investments.

This led Arup to reimagine its identity security with Face Check and Microsoft Entra Verified ID as the foundation of a new Arup Identity Verification Service.

Arup built its Arup Identity Verification Service entirely on Microsoft technologies, using Microsoft Entra ID and Azure services on the back end and Face Check with Microsoft Entra Verified ID on the front end. Here’s how the process works today:

• Initial registration: Employees register a photo of themselves taken from an official identification source. Currently, Arup uses Microsoft 365 profile images, with support for government-issued IDs planned for a future iteration.
• Real-time verification: When an employee needs a sensitive action—such as a password reset—the Help Desk asks them to submit a real-time selfie.
• AI-powered matching: Face Check, powered by Azure AI services and Verified ID APIs, compares the selfie to the registered photo.
• Privacy by design: Only the match result (pass/fail) is shared with the Help Desk and systems. No sensitive personal image data is exposed, which helps safeguard employee privacy.

Arup’s development team used Azure App Service (Web Apps) and several Verified ID APIs to integrate Face Check with other business processes. This allows face biometric verification to be reused across the environment, not just at the Help Desk.

Arup is using Face Check with Microsoft Entra Verified ID to reshape how it balances security, convenience, and privacy across the organization. Key benefits include:

• Higher assurance for high-risk activities: Face Check adds a strong verification step for scenarios like password resets and high-value financial transactions. For example, the procurement team piloted Face Check for corporate credit card purchases to verify that the person requesting a purchase is genuine and authorized.
• Granular access control: By combining Face Check with Microsoft Entra ID Conditional Access policies, Arup can grant very specific access to confidential resources—particularly useful for roles that manage budgets and approvals.
• Stronger defense against deepfakes: The biometric verification layer helps Arup counter AI-generated impersonations that could otherwise be used for fraud or data theft.
• Privacy and user acceptance: Because only match results are shared, not raw biometric data, Arup can maintain user privacy while still increasing security. This privacy-aware design has contributed to strong internal adoption.
• Operational simplicity: The solution streamlines verification into a simple, one-step workflow for employees, while integrating cleanly with existing Microsoft Security and Azure services for IT and development teams.

Overall, Arup is using Face Check to deepen its layers of defense and embed a culture of security that supports a more secure future for its people, data, and financial operations.