Microsoft Entra Passwordless Authentication — Complete Field Guide

ENTRA ID · Modern Endpoint Guides

🔑 Microsoft Entra Passwordless Authentication

Eliminate passwords entirely with FIDO2 security keys, Windows Hello for Business, and Microsoft Authenticator phone sign-in. Step-by-step deployment guide — from policy enablement to end-user rollout.

FIDO2 Windows Hello for Business Phishing-Resistant MFA Zero Trust

📋 Why Passwordless?

Passwords are the root cause of over 80% of identity breaches — phishing, credential stuffing, and spray attacks all exploit them. Microsoft Entra Passwordless replaces the password with cryptographic credentials tied to the device and the user, making phishing structurally impossible.

entra.microsoft.com › Identity › Overview › Security Score
🏠 Home
🔐 Identity
🔒 Protection
⚙️ Authentication
Home › Identity Secure Score
Secure Score — Identity
Improvement ActionScore ImpactStatus
Require MFA for all users +10 pts Complete
Enable passwordless sign-in for users +9 pts In Progress
Block legacy authentication +7 pts Not Started
Register FIDO2 security keys +6 pts In Progress
💡 Passwordless contributes up to +15 points to your Microsoft Secure Score — the highest single-action identity improvement available.
📸 Microsoft Entra admin center — Identity Secure Score. Enabling passwordless is one of the highest-impact security improvements available.
Traditional PasswordPasswordless (Entra)
Phishable via fake login pagesCryptographically bound to origin — phishing-resistant
Reused across sitesUnique key pair per service
Stolen in breach databasesPrivate key never leaves device
Spray / brute-force attacksNo password to brute-force
Requires complex password policyBiometric or PIN — simpler UX, stronger security

🛡️ Passwordless Authentication Methods

Entra supports three passwordless methods. Choose based on user role, device type, and security requirements.

Phishing-Resistant Hardware

🔐 FIDO2 Security Keys

Hardware tokens (YubiKey, Feitian, etc.) containing a private key that never leaves the device. Authentication requires physical possession + PIN/biometric. Best for shared workstations, privileged admins, and high-security scenarios.

  • Platforms: Windows 10/11, macOS, Linux, iOS, Android
  • Works on: Entra-joined, Hybrid-joined, BYOD browsers
  • Best for: Admins, shared machines, SOC analysts
Phishing-Resistant Built-in

💻 Windows Hello for Business (WHfB)

Asymmetric key pair provisioned on the TPM chip of a Windows device. Sign in with face, fingerprint, or PIN — the PIN unlocks the TPM key, not a password. Works offline and on-premises.

  • Platforms: Windows 10/11 with TPM 2.0
  • Works on: Entra-joined, Hybrid-joined devices
  • Best for: Corporate laptop/desktop users
Phishing-Resistant (Passkey)

📱 Microsoft Authenticator — Phone Sign-in / Passkey

Two modes: (1) Phone sign-in — approve a push notification with number matching; (2) Passkey (FIDO2) — phone stores a FIDO2 passkey, sign in with biometric. Passkey mode is phishing-resistant; phone sign-in has number matching to mitigate MFA fatigue.

  • Platforms: iOS 17+, Android 9+
  • Works on: All Entra-joined and personal devices
  • Best for: Information workers, remote employees, BYOD
MethodPhishing-ResistantWorks OfflineHardware RequiredIdeal Scenario
FIDO2 Key✅ Yes✅ Yes✅ TokenAdmins, shared PCs
Windows Hello for Business✅ Yes✅ YesTPM 2.0 (built-in)Corporate laptops
Authenticator Passkey✅ Yes✅ YesPhoneMobile workers, BYOD
Authenticator Phone Sign-in⚠️ Number matching❌ NoPhoneGeneral workforce

⚙️ Step 1 — Enable Authentication Methods Policy

All passwordless methods are controlled from the Authentication Methods Policy in Entra. This is the single control plane — the legacy MFA settings in the Microsoft 365 admin center are deprecated.

1

Navigate to Authentication Methods

Entra admin center → Protection → Authentication methods → Policies

📍 entra.microsoft.com › Protection › Authentication methods › Policies
2

Select each method to configure

You'll see: FIDO2 security key, Microsoft Authenticator, Windows Hello for Business. Click each to enable and scope.

3

Scope to a pilot group first

Set Target → Select group → Passwordless-Pilot. Enable for all users only after pilot success.

⚠️ Do NOT enable for all users immediately — pilot with 20-50 users and resolve registration blockers first.
entra.microsoft.com › Protection › Authentication methods › Policies
🔒 Protection
🔑 Authentication methods
📋 Policies
📊 Activity
Protection › Authentication methods › Policies
Authentication methods — Policies
MethodStateTarget
🔐 FIDO2 security key Enabled Passwordless-Pilot (42 users)
📱 Microsoft Authenticator Enabled All users
💻 Windows Hello for Business Enabled All users
📲 SMS Enabled All users (reduce over time)
🔑 Temporary Access Pass Enabled Helpdesk group
💡 Enable Temporary Access Pass (TAP) for helpdesk. TAP is a time-limited passcode used to bootstrap passwordless registration without a password — essential for new hires and key recovery.
📸 Entra › Authentication Methods › Policies — FIDO2 enabled for pilot group, Authenticator and WHfB enabled for all, TAP enabled for helpdesk.
💡 Temporary Access Pass (TAP) — Enable TAP in Authentication Methods and assign it to Helpdesk admins. When a user loses their passwordless credential, helpdesk issues a TAP → user signs in → registers new credential → TAP expires. This is the passwordless break-glass recovery path.

🔐 Step 2 — Configure FIDO2 Security Keys

FIDO2 keys are the strongest passwordless option — hardware-bound, phishing-resistant, works on shared PCs without a user profile. Required for privileged accounts.

1

Enable FIDO2 in Authentication Methods Policy

Entra admin center → Protection → Authentication methods → FIDO2 security key → Enable → Select target group

2

Configure FIDO2 Settings

Allow self-service setup: Yes | Enforce attestation: Yes (for high-security) | Enforce key restrictions: Optional (to limit to specific vendors)

📍 FIDO2 Policy → Configure tab → Key restrictions: add AAGUIDs of approved keys (YubiKey, Feitian, etc.)
3

User Self-Registration — Security Info

User navigates to: aka.ms/mysecurityinfo → + Add method → Security key → USB device or NFC → Insert key → Set PIN → Touch key to confirm

4

Sign in with FIDO2 Key

Windows sign-in → Sign-in options → Security key → Enter PIN → Touch key. Browser sign-in → use passkey/security key option in the Entra login page.

mysecurityinfo.microsoft.com › Security info › Add method
🔐 Security info
📱 Devices
🔑 Passkeys
Security info › Add sign-in method
Add a method — Security key (FIDO2)
🔐
Set up your security key
Insert your USB security key or hold your NFC key near your device
USB device
NFC device
Step 2 of 4: Create a PIN for your security key (min. 4 digits, max 63 characters)
Security key PIN
Confirm PIN
💡 Touch the gold contact on your key when it blinks — this is the user presence confirmation required by FIDO2 protocol.
📸 mysecurityinfo.microsoft.com — FIDO2 security key registration flow. User inserts key, sets a PIN, and confirms with a physical touch.
⚠️ Key Restriction Important Note: If you enforce key restrictions (AAGUID allowlist), users cannot register any key not on the list — including keys they may already own. Coordinate with procurement before enabling restrictions in production.

💻 Step 3 — Windows Hello for Business (WHfB)

WHfB provisions a key pair on the device TPM at first sign-in. The user signs in with face, fingerprint, or a local PIN — the PIN unlocks the TPM key, not an AD or Entra password. No password is sent over the network.

Prerequisites

RequirementDetail
Device join typeEntra-joined (cloud-only) or Hybrid Entra-joined
TPMTPM 2.0 required (most devices after 2016 have it)
Intune / GPOIntune policy OR Group Policy to configure WHfB
OSWindows 10 1903+ or Windows 11
LicenseEntra ID P1 or P2 (included in M365 E3/E5)
1

Create WHfB Intune Policy

Intune admin center → Endpoint security → Account protection → Create policy → Windows → Windows Hello for Business

📍 intune.microsoft.com › Endpoint security › Account protection
2

Configure Key Settings

Configure Windows Hello for Business: Enable | Use a Trusted Platform Module (TPM): Required | Minimum PIN length: 6 | Biometrics: Enable

3

Assign to Pilot Group

Assignments → Add groups → Passwordless-Pilot-Devices. Exclude helpdesk and shared kiosks until they have separate policies.

4

User Experience — First Sign-in

After policy applies, Windows prompts: "Your organization requires Windows Hello." → User sets PIN → Camera scans face or fingerprint reader enrolls biometric → Done.

📍 Provisioning happens at first sign-in after policy applies — typically within 15 minutes of device enrollment or next sync.
intune.microsoft.com › Endpoint security › Account protection › WHfB Policy
🏠 Home
💻 Devices
🔒 Endpoint security
📋 Account protection
Endpoint security › Account protection › WHfB-Corp-Policy
Windows Hello for Business — WHfB-Corp-Policy
Configuration settings
SettingValue
Configure Windows Hello for BusinessEnable
Use a Trusted Platform Module (TPM)Required
Minimum PIN length6 characters
Maximum PIN length127 characters
Lowercase letters in PINNot configured
Use biometricsEnable
Use enhanced anti-spoofingEnable
Certificate for on-premises resourcesNot configured (cloud-only)
⚠️ Require TPM ensures keys are hardware-protected. Without this, keys may store in software — acceptable for testing, not production.
📸 Intune › Endpoint Security › Account Protection — WHfB policy with TPM Required, biometrics enabled, and anti-spoofing enforcement.

📱 Step 4 — Microsoft Authenticator Passwordless

For mobile workers and BYOD scenarios. Two levels: Phone sign-in (approve push notification with number matching) and Passkey (FIDO2 on phone — phishing-resistant, works even offline).

1

Enable Microsoft Authenticator in Policy

Entra admin center → Protection → Authentication methods → Microsoft Authenticator → Enable → Configure

2

Enable Passkey (FIDO2) in Authenticator

In the Authenticator policy settings, enable: Allow use of Microsoft Authenticator OTP — OFF | Passwordless sign-in — ON | Show app name / location in notification — ON | Number matching — Enabled

📍 Number matching prevents MFA fatigue attacks — user must type the number shown on login screen into the app.
3

User Registers Passkey — Security Info

User → aka.ms/mysecurityinfo → Add method → Passkey (Microsoft Authenticator) → Scan QR code → Biometric confirmation on phone → Done

4

Sign In — Passwordless Flow

Login page → enter username → "Approve a request on the Microsoft Authenticator app" → notification appears → user approves with biometric. For passkey: select "Sign in another way" → Passkey → biometric on phone.

entra.microsoft.com › Protection › Authentication methods › Microsoft Authenticator
🔒 Protection
📱 Authenticator
⚙️ Configure
Authentication methods › Microsoft Authenticator › Configure
Microsoft Authenticator — Advanced settings
Passwordless & MFA Settings
Require number matching
Enabled — Microsoft managed
Show app name in push notifications
Enabled
Show geographic location in push notifications
Enabled
Passwordless sign-in (phone sign-in)
Enabled
💡 Passkey (FIDO2) in Authenticator is registered separately via Security Info (aka.ms/mysecurityinfo) — it appears as a Passkey entry, not as an Authenticator entry.
📸 Entra › Authentication Methods › Microsoft Authenticator advanced settings. Number matching and location context must be enabled to mitigate MFA fatigue.

🔒 Step 5 — Conditional Access for Passwordless

Create two CA policies: one requiring phishing-resistant MFA for privileged roles, and one to drive the general workforce toward passwordless over time.

1

Policy 1 — Require Phishing-Resistant MFA for Admins

Users: All directory roles (Global Admin, etc.) | Conditions: All apps | Grant: Require authentication strength → Phishing-resistant MFA

📍 Phishing-resistant MFA strength = FIDO2 key OR WHfB OR Authenticator Passkey. Excludes phone sign-in and TOTP.
2

Policy 2 — Nudge Workforce Toward Passwordless

Users: All users | Apps: Office 365 | Grant: Require MFA (allows any MFA) → Enable registration nudge in Authenticator settings to prompt users to set up passkeys.

3

Policy 3 — Block Legacy Authentication

Users: All | Conditions: Client apps → Other clients (legacy auth) | Grant: Block. Legacy auth cannot satisfy modern MFA — it must be blocked.

entra.microsoft.com › Protection › Conditional Access › Policies › New policy
🔒 Protection
📋 Conditional Access
+ New policy
Conditional Access › CA-ADMIN-PhishingResistant-MFA
CA-ADMIN-PhishingResistant-MFA
Assignments
SectionSetting
UsersDirectory roles: All privileged admin roles
Target resourcesAll cloud apps
Conditions → Sign-in riskNot configured (admin policy applies always)
Access controls — Grant
SettingValue
Grant access✅ Selected
Require authentication strengthPhishing-resistant MFA
⚠️ Enable in Report-only mode first. Monitor sign-in logs for 1-2 weeks before switching to Enabled — look for any admin accounts without a passwordless credential registered.
📸 CA policy for admins requiring phishing-resistant MFA strength. Always start in Report-only and monitor the sign-in logs before enforcing.
⚠️ Break-glass accounts: Exclude your break-glass emergency admin accounts from ALL CA policies. These accounts should have long random passwords stored in a sealed envelope — not passwordless. They are your recovery path if CA policies lock everyone out.

⭐ Step 7 — Set Passwordless as Default for Specific Users

By default, Entra presents the sign-in method the user registered first — often a password + SMS. Two mechanisms let you change this: System-preferred MFA (nudges Entra to offer the strongest method first) and a CA authentication strength policy (enforces it hard).

Option A — System-preferred MFA (Recommended First Step)

Entra automatically evaluates which passwordless method the user has registered and presents it first. The priority order:

PriorityMethodCondition
1stFIDO2 security keyUser has registered a key
2ndWindows Hello for BusinessDevice is Entra/Hybrid joined with TPM
3rdAuthenticator PasskeyPasskey registered in Authenticator app
4thAuthenticator push notificationAuthenticator registered
5thTOTP / SMSFallback only
1

Navigate to Authentication Methods → Settings

Entra admin center → Protection → Authentication methods → Settings

📍 entra.microsoft.com › Protection › Authentication methods › Settings
2

Enable System-preferred MFA

Find "System-preferred multifactor authentication" → Set to Microsoft managed (on by default for new tenants) or explicitly Enabled.

3

Scope to target group

Include: Passwordless-Pilot group. Exclude: users still in onboarding who haven't registered a passwordless method yet.

⚠️ If a user has no passwordless method registered, system-preferred MFA falls back to their strongest registered method — it never blocks sign-in.
entra.microsoft.com › Protection › Authentication methods › Settings
🔒 Protection
🔑 Authentication methods
⚙️ Settings
Authentication methods › Settings
Authentication methods — Settings
System-preferred multifactor authentication
State
When enabled, Entra ID presents the strongest available authentication method to the user.
Enabled
Target
Include
Passwordless-Pilot
Exclude
Onboarding-Users
💡 System-preferred MFA is a nudge, not an enforcement. Users can still click "Use a different method". Use Option B to enforce hard.
📸 Entra › Authentication methods › Settings — System-preferred MFA enabled for the Passwordless-Pilot group.

Option B — Enforce with Conditional Access Authentication Strength

Hard enforcement: users in scope cannot sign in with password + SMS — they must use a passwordless method. Use this after the pilot group has successfully registered.

1

Create a new CA Policy

Protection → Conditional Access → New policy → Name: CA-Passwordless-Enforce-Pilot

2

Assignments

Users: Include → Passwordless-Pilot group | Resources: All cloud apps (or Office 365)

3

Grant — Authentication Strength

Grant access → Require authentication strength → Passwordless MFA (includes FIDO2, WHfB, Authenticator Passkey — excludes password + push).

📍 "Passwordless MFA" is a built-in Entra preset. You can create a custom strength to restrict further (e.g. FIDO2 only).
4

Start in Report-only

Set policy state to Report-only. Monitor sign-in logs for "Report-only: Failure" entries. Switch to Enabled only after all group members have a passwordless credential registered.

entra.microsoft.com › Protection › Conditional Access › CA-Passwordless-Enforce-Pilot
🔒 Protection
📋 Conditional Access
Conditional Access › CA-Passwordless-Enforce-Pilot
CA-Passwordless-Enforce-Pilot
SectionSetting
Users — IncludePasswordless-Pilot
Users — ExcludeBreak-Glass-Accounts
Target resourcesAll cloud apps
Authentication strengthPasswordless MFA
Policy stateReport-only
⚠️ Before enabling: Sign-in logs → filter by this policy → look for "Report-only: Failure". Each entry = a user who will be blocked.
📸 CA policy enforcing Passwordless MFA strength for the pilot group. Report-only first — verify all users have registered before enabling.
⚠️ Always verify registration before enforcing: Filter sign-in logs by group + CA policy + Report-only: Failure before switching to Enabled. Every user in that list will be locked out the moment you enable the policy.

📊 Step 6 — Monitor Passwordless Adoption

Track registration progress, sign-in method usage, and authentication failures from the Entra admin center.

entra.microsoft.com › Identity › Monitoring › Authentication methods activity
📊 Monitoring
🔑 Auth methods activity
📈 Sign-in logs
Monitoring › Authentication methods activity
Authentication methods — Usage & Insights
MethodRegistered usersSign-ins (30d)% of total
Windows Hello for Business 847 24,310 41%
Microsoft Authenticator (push) 1,203 18,640 31%
FIDO2 security key 67 3,880 6%
Password (password hash sync) 1,500 12,700 22%
💡 Target: password sign-ins → <5% within 6 months. Use the "Registration and reset events" report to identify users still needing passwordless enrollment.
📸 Entra › Monitoring › Authentication methods activity. Use this dashboard weekly to track passwordless adoption and identify stragglers.

Key Metrics to Track

MetricTargetWhere to Find
% users with passwordless registered>80% in 90 daysAuth methods activity → Registration
% sign-ins using passwordless>70% in 180 daysAuth methods activity → Usage
SSPR registration rate>95%Auth methods activity
CA policy failures (block)<1% per daySign-in logs → filter by Failure
Legacy auth sign-in attempts0 after block policySign-in logs → Client app = Other clients

✅ Deployment Checklist — Entra Passwordless

    🏗️ Foundation
  • Authentication Methods Policy — migrated from legacy MFA settings
  • Temporary Access Pass (TAP) — enabled and scoped to helpdesk
  • Break-glass accounts — excluded from all CA policies
  • Pilot group created (20-50 users covering IT, HR, Finance)
    • 🔐 FIDO2 Security Keys
  • FIDO2 enabled in Authentication Methods for pilot group
  • Approved key vendors list configured (if key restrictions needed)
  • Users registered keys via aka.ms/mysecurityinfo
  • Windows sign-in via security key tested successfully
    • 💻 Windows Hello for Business
  • TPM 2.0 confirmed on all target devices
  • WHfB Intune policy created and assigned to pilot group
  • Biometrics (face/fingerprint) enabled in policy
  • Users completed WHfB provisioning at first sign-in
  • Hybrid key trust configured (for hybrid-joined devices)
    • 📱 Microsoft Authenticator
  • Authenticator passwordless enabled in policy
  • Number matching — Enabled (Microsoft managed)
  • App name and location in notifications — Enabled
  • Users registered phone sign-in via Security Info
    • 🔒 Conditional Access
  • CA policy: Admins → Phishing-resistant MFA (Report-only first)
  • CA policy: All users → Require MFA for Office 365
  • CA policy: Block legacy authentication
  • CA policies moved from Report-only → Enabled after monitoring period
    • 📊 Monitoring
  • Auth methods activity dashboard reviewed weekly
  • Sign-in log alerts for legacy auth attempts
  • Passwordless adoption % tracked monthly
  • Rollout expanded from pilot → department → all users