implementing-passwordless-auth-with-microsoft-entra

What problem does it solve?

Enterprises face persistent password-based threats such as phishing, credential stuffing, and brute-force attacks; this Skill provides a repeatable, phishing-resistant path to eliminate passwords by enabling FIDO2 keys, passkeys, Windows Hello for Business, and certificate-based authentication in Microsoft Entra ID.

Core Features & Use Cases

• Authentication Method Configuration: Guides enabling and hardening FIDO2, Microsoft Authenticator passkeys, and Windows Hello for Business via Microsoft Graph and PowerShell.
• Conditional Access & Auth Strength: Shows how to create authentication strength and Conditional Access policies that require phishing-resistant methods for high-risk apps and admin roles.
• Deployment & Recovery Workflows: Covers Intune WHfB profile deployment, Temporary Access Pass for bulk registration, legacy auth blocking, and monitoring adoption with sign-in analytics.
• Use Case: Migrate a 5,000-user enterprise from SMS-based MFA to a phased passwordless deployment that enforces phishing-resistant authentication for admins and high-risk applications while tracking adoption.

Quick Start

Run the included audit agent with tenant, client ID, and client secret to inventory passwordless configuration, identify users without passwordless methods, and produce an adoption report.