Microsoft Entra ID Passwordless Authentication Complete Guide: Authenticator, FIDO2, Windows Hello, TAP, CBA

Passwordless authentication lets users sign in without ever typing a password, and is widely considered the endgame of modern enterprise security strategy. Microsoft's internal data shows passwordless is 99.9% safer than password + MFA, and Microsoft itself has already completed full internal passwordless adoption. This article walks through all five passwordless methods in Microsoft Entra ID, when to use each, and a phased rollout roadmap.

The Five Passwordless Methods

Microsoft Authenticator

Authentication via smartphone push approval plus number matching. The most widely adopted method — minimal cost, easy to deploy, and the standard for all employees.

Number Matching (standardized in 2023)

At sign-in, a two-digit number is shown on the web side and the user must enter it in the Authenticator app.

• Plain push notifications (tap Yes/No) were vulnerable to MFA fatigue attacks
• Number Matching now requires the user to physically prove they are operating the same session
• Microsoft enforced Number Matching tenant-wide in May 2023
• Social-engineering-based MFA bypasses have dropped significantly

FIDO2 Security Keys

FIDO2 (Fast IDentity Online v2) is hardware-token authentication based on the WebAuthn standard. Highest security of any passwordless method.

Supported Keys

• YubiKey 5 series (most popular)
• Feitian ePass
• SoloKey
• Other Microsoft-certified keys

Rollout Steps

1. Enable the Passkey (FIDO2) method in Microsoft Entra ID (Authentication methods policy)
2. Use Conditional Access to require FIDO2 for privileged roles
3. Users register a FIDO2 key in Entra ID Security info (set a PIN and touch the key)
4. Sign in thereafter with the FIDO2 key (USB insert or NFC tap + touch + PIN)

Cost: about USD 50 per YubiKey 5 NFC. Equipping 10-50 privileged users runs into the low thousands of dollars for a major security boost. Always keep two backup keys per user (one stored in a secure offsite location).

Windows Hello for Business

The passwordless authentication built into Windows 10/11. It uses biometrics (face or fingerprint) or a PIN backed by the TPM.

Three Deployment Models

Cloud Kerberos Trust is the simplest model and ideal for organizations managing Windows devices with Entra ID + Intune. The standard pattern is to push a Configuration Profile from Intune that requires Windows Hello for Business across the company.

Temporary Access Pass (TAP)

A time-bound one-time passcode used as a fallback when users register or lose Microsoft Authenticator or FIDO2 keys.

Typical Use Cases

• New-hire onboarding: hand the new hire a TAP for day-one access, then have them register Authenticator
• Emergency access after losing a FIDO2 key: reauthenticate with a TAP, then register a new FIDO2 key
• Initial access to legacy accounts after enforcing passwordless

How to Generate

• In the Entra ID admin center: user → Authentication methods → Temporary Access Pass → Generate
• Lifetime 1 hour to 30 days, usage count configurable, one-time or multi-use

In production, the standard pattern is to delegate TAP issuance to the IT help desk team to streamline user support.

Certificate-based Authentication (CBA)

Authentication that stores certificates on smart cards, PIV cards, or USB tokens and authenticates via PKI.

• Compliance for government and financial institutions
• Supports standards like HSPD-12 (US government), eIDAS (EU), and My Number Card (Japan)
• Native support via Microsoft Entra Certificate-based Authentication (GA 2023, direct Entra ID authentication without AD FS)
• Certificate revocation checks via CRL / OCSP
• High deployment cost (PKI build-out, card readers, card issuance)

Phased Rollout Roadmap

A 12-18 month plan for full passwordless migration:

Phase 1 (months 1-3): Company-wide Authenticator rollout

• Enforce Microsoft Authenticator for all employees
• Enforce Number Matching (already standardized by Microsoft)
• Recommend passwordless (passwords still allowed)

Phase 2 (months 3-6): Windows Hello + FIDO2 for privileged roles

• Enforce Windows Hello for Business on every Windows device (via Intune)
• Deploy FIDO2 to about 50 privileged users
• Use Authentication strength policy to require passwordless for critical apps

Phase 3 (months 6-12): Block password authentication

• Enable a Conditional Access policy that blocks password authentication
• Complete passwordless migration (Self-Service Password Reset reserved for emergencies)

Phase 4 (months 12-18): Disable weak MFA

• Disable legacy MFA (SMS, voice call) in the Authentication methods policy
• Consolidate on the strongest MFA methods only

Operational Best Practices

1. All employees = Microsoft Authenticator + Number Matching as the minimum baseline
2. Privileged roles (Global Admin, PIM-eligible) = FIDO2 security key mandatory
3. Keep two backup FIDO2 keys per user (one in secure storage)
4. Enforce Windows Hello for Business on Windows users via Intune
5. Issue a TAP to new hires on day one and guide them through Authenticator registration
6. Use Conditional Access Authentication strength to require passwordless for critical apps
7. Phase out SMS MFA over time (anti-phishing)
8. Enforce auto-updates for the Microsoft Authenticator app (Intune App Protection Policy)
9. Continuously monitor MFA failure rates in Microsoft Sentinel
10. Review passwordless adoption rates regularly (Authentication Methods Activity report)

Related Certifications

• SC-300 (Identity and Access Administrator Associate): The flagship certification for this area — Domain 2 (Authentication, 25-30%) covers it in depth
• SC-100 (Cybersecurity Architect Expert): Authentication hardening as part of Zero Trust strategy
• MS-102 (Microsoft 365 Administrator Expert): Domain 2 covers company-wide rollout strategy
• AZ-104 (Administrator): Foundational coverage

Frequently Asked Questions

Technical information in this article is based on the Microsoft Entra Passwordless Authentication Documentation. This article is not an official Microsoft Corporation product and has no partnership or sponsorship relationship. Microsoft, Azure, Microsoft Entra, and Windows Hello are trademarks of the Microsoft group of companies. FIDO2 / WebAuthn are standards from the FIDO Alliance / W3C. Information is based on official materials published as of May 24, 2026. Always confirm the latest details on the official pages.