- **Exact** — Claims must match exactly.
- **Relaxed** — Uses cross-field word matching to accommodate variations in how names appear on government-issued documents versus Microsoft Entra ID user profiles. For details on how relaxed matching works, see [How is the Verified ID matched against Microsoft Entra ID account details?](self-service-account-recovery.yml#how-is-the-verified-id-matched-against-microsoft-entra-id-account-details-)
1. (Optional) Under **Additional claim validations**, enable a custom authentication extension to add organization-specific account matching logic during recovery. For an example of a custom authentication extension that validates Verified ID claims during Microsoft Entra account recovery, see [Create a custom authentication extension for account recovery claim validation](/identity-platform/tutorial-custom-authentication-extension-account-recovery).
This step requires a pre-configured Azure Function, Logic App, or REST endpoint that connects to your organization's data — such as an HRIS system, employee directory, or other authoritative source. During recovery, verified claims from the identity verification provider are passed to your endpoint, which validates them against your organizational data and returns a match decision.
## Related content
- [How end users can perform account recovery in Microsoft Entra ID](how-to-account-recovery-for-users.md)
- [Create a custom authentication extension for account recovery claim validation](/identity-platform/tutorial-custom-authentication-extension-account-recovery)
- [FAQ for account recovery](self-service-account-recovery.yml)
- **Exact** — Claims must match exactly.
- **Relaxed** — Uses cross-field word matching to accommodate variations in how names appear on government-issued documents versus Microsoft Entra ID user profiles. For details on how relaxed matching works, see [How is the Verified ID matched against Microsoft Entra ID account details?](self-service-account-recovery.yml#how-is-the-verified-id-matched-against-microsoft-entra-id-account-details-)
1. (Optional) Under **Additional claim validations**, enable a custom authentication extension to add organization-specific account matching logic during recovery. For an example of a custom authentication extension that validates Verified ID claims during Microsoft Entra account recovery, see [Create a custom authentication extension for account recovery claim validation](/entra/identity-platform/tutorial-custom-authentication-extension-account-recovery).
This step requires a pre-configured Azure Function, Logic App, or REST endpoint that connects to your organization's data — such as an HRIS system, employee directory, or other authoritative source. During recovery, verified claims from the identity verification provider are passed to your endpoint, which validates them against your organizational data and returns a match decision.
## Related content
- [How end users can perform account recovery in Microsoft Entra ID](how-to-account-recovery-for-users.md)
- [Create a custom authentication extension for account recovery claim validation](/entra/identity-platform/tutorial-custom-authentication-extension-account-recovery)
- [FAQ for account recovery](self-service-account-recovery.yml)