<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-passwordless-authentication
description: >-
  Implement and audit passwordless authentication using FIDO2 security keys,
  Windows Hello for Business, Microsoft Authenticator, passkeys, and
  certificate-based authentication. Covers enrollment policies, phishing
  resistance evaluation, and fallback mechanism security.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - passwordless
  - fido2
  - webauthn
  - passkeys
  - windows-hello
  - phishing-resistant
  - azure-ad
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1110"]
---

# Implementing Passwordless Authentication

## Overview

Passwordless authentication eliminates the primary credential theft vector.
FIDO2/WebAuthn provides phishing-resistant authentication by binding credentials
to origin domains — a phishing site cannot relay a FIDO2 assertion. The
transition requires careful policy design: enrollment security, fallback
mechanisms, and recovery flows each introduce attack surface that must be
hardened independently.

Mode: `[MODE: ARCHITECT]` for deployment design; `[MODE: RED]` for bypass testing.

MITRE ATT&CK: T1556 (Modify Authentication Process), T1078 (Valid Accounts)

## Prerequisites

- Azure AD P1+ (authentication methods policy)
- FIDO2 security keys (YubiKey 5, Titan, Feitian)
- Windows 10/11 with TPM 2.0 (Windows Hello for Business)
- Okta with FastPass or FIDO2 policy
- Python 3.10+ for agent tooling

## Key Concepts

### Passwordless Method Comparison

| Method | Phishing Resistant | Hardware Required | Platform |
|--------|-------------------|-------------------|----------|
| FIDO2 Security Key | Yes | Yes (USB/NFC key) | Cross-platform |
| Windows Hello | Yes | TPM 2.0 | Windows only |
| Passkeys (synced) | Yes | No (device-bound) | Cross-platform |
| MS Authenticator | Partial (number match) | Phone | Cross-platform |
| Certificate-Based | Yes | Smart card/virtual | Cross-platform |
| SMS/Phone OTP | No | Phone | Cross-platform |

### Azure AD Passwordless Configuration

```powershell
# Connect and configure authentication methods
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"

# Enable FIDO2 security keys
$fido2Config = @{
    State = "enabled"
    IncludeTargets = @(@{
        TargetType = "group"
        Id = "fido2-pilot-group-id"
    })
    IsAttestationEnforced = $true
    IsSelfServiceRegistrationAllowed = $true
    KeyRestrictions = @{
        IsEnforced = $true
        EnforcementType = "allow"
        AaGuids = @(
            "cb69481e-8ff7-4039-93ec-0a2729a154a8"  # YubiKey 5
            "ee882879-721c-4913-9775-3dfcce97072a"  # Titan
        )
    }
}
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
    -AuthenticationMethodConfigurationId "fido2" `
    -BodyParameter $fido2Config

# Enable Windows Hello for Business
$whoConfig = @{
    State = "enabled"
    IncludeTargets = @(@{
        TargetType = "group"
        Id = "all-users-group-id"
    })
}
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
    -AuthenticationMethodConfigurationId "windowsHelloForBusiness" `
    -BodyParameter $whoConfig

# Disable legacy methods (SMS, voice)
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
    -AuthenticationMethodConfigurationId "sms" `
    -State "disabled"
```

### FIDO2 Registration Audit

```powershell
# List all registered FIDO2 keys per user
Get-MgUserAuthenticationFido2Method -UserId "user@contoso.com" |
  Select-Object Id, DisplayName, Model, CreatedDateTime,
    AttestationLevel, AaGuid

# Find users with no passwordless methods registered
$users = Get-MgUser -All -Property Id, UserPrincipalName
foreach ($user in $users) {
    $fido2 = Get-MgUserAuthenticationFido2Method -UserId $user.Id
    $whfb = Get-MgUserAuthenticationWindowsHelloForBusinessMethod -UserId $user.Id
    if (-not $fido2 -and -not $whfb) {
        Write-Output "$($user.UserPrincipalName): No passwordless methods"
    }
}
```

### Conditional Access — Require Phishing-Resistant MFA

```powershell
# Create Conditional Access policy requiring phishing-resistant auth
$caPolicy = @{
    DisplayName = "Require phishing-resistant MFA for admins"
    State = "enabledForReportingButNotEnforced"
    Conditions = @{
        Users = @{
            IncludeRoles = @(
                "62e90394-69f5-4237-9190-012177145e10"  # Global Admin
                "194ae4cb-b126-40b2-bd5b-6091b380977d"  # Security Admin
            )
        }
        Applications = @{ IncludeApplications = @("All") }
    }
    GrantControls = @{
        Operator = "OR"
        AuthenticationStrength = @{
            Id = "00000000-0000-0000-0000-000000000004"  # Phishing-resistant
        }
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy
```

## Workflow

1. **Assess** — Inventory current authentication methods per user population
2. **Pilot** — Deploy FIDO2 keys to IT/security team, validate enrollment flow
3. **Policy** — Create Conditional Access requiring passwordless for admins
4. **Enroll** — Roll out to broader population with self-service registration
5. **Disable Legacy** — Block SMS, voice call, and app password methods
6. **Monitor** — Track registration rates, fallback usage, authentication failures
7. **Enforce** — Move Conditional Access policy from report-only to enforced

## Detection

```yaml
title: Passwordless Authentication Detection
id: 7737bdb4-5d4b-4c7b-bd45-ea19681747c5
status: experimental
description: Detects suspicious activity related to implementing passwordless authentication techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1110
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```

## Verification

- [ ] FIDO2 attestation enforced — only approved key vendors accepted
- [ ] All Global/Security Admins have phishing-resistant MFA registered
- [ ] SMS and voice call authentication methods disabled
- [ ] Conditional Access policy requires phishing-resistant auth for admins
- [ ] Self-service FIDO2 registration requires existing strong authentication
- [ ] Recovery flow documented — break-glass accounts with hardware tokens
- [ ] Authentication method registration events logged to SIEM
- [ ] Temporary Access Pass policy scoped and time-limited (< 1 hour)

## References

- [Microsoft — Passwordless Authentication](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless)
- [FIDO Alliance — FIDO2 Specifications](https://fidoalliance.org/fido2/)
- [W3C WebAuthn](https://www.w3.org/TR/webauthn-3/)
- [CISA — Phishing-Resistant MFA Guidance](https://www.cisa.gov/mfa)
- [MITRE ATT&CK T1556](https://attack.mitre.org/techniques/T1556/)
