What is the best course of action to implement passwordless for hybrid joined devices?

Adalfarus Adalfarus 0 Reputation points
2024-08-21T15:56:19.1933333+00:00

I have reviewed the official documentation, but I am uncertain about the best way to set up passwordless authentication for Windows and MacOS devices that are connected to an on-premises Active Directory. The challenge is that users are connected to both Entra ID and the on-premises environment. Currently, users are authenticated through the Active Directory when logging in to the device, and through Entra ID for all cloud resources.

Microsoft Authenticator
Microsoft Authenticator
A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation.
6,605 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,430 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,365 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Neuvi Jiang 1,075 Reputation points Microsoft Vendor
    2024-08-23T08:05:15.0333333+00:00

    Hi Adalfarus Adalfarus,

    Thank you for posting in the Q&A Forums.

    Microsoft offers several passwordless authentication methods that integrate with Entra ID and local Active Directory. The main methods include:

    Microsoft Authenticator:

    For iOS and Android devices that can be converted to strong passwordless credentials.

    Users can log in to any platform or browser from their phone without having to enter a password.

    FIDO2 Security Key:

    For users who log in to a shared computer (such as a booth) or have limited access to their phone.

    Provides secure hardware-based authentication and reduces the risk of fraud.

    Windows Hello Enterprise:

    Designed for users with dedicated Windows computers.

    Supports multiple authentication methods such as biometrics (e.g., fingerprint or facial recognition) and PIN codes.

    Platform Credential for macOS:

    A new feature on macOS that uses the Microsoft Enterprise Single Sign-On Extension (SSOe) to enable passwordless sign-on.

    Second, set up passwordless authentication for Windows devices

    Enable Windows Hello Enterprise:

    Ensure that Windows 10 version is at least 1703 and update to the recommended version (e.g. 1903 or higher).

    Configure Windows Hello Enterprise Edition policies in Active Directory, including enrollment and unlock policies.

    Deploy the necessary certificate and key management infrastructure.

    Integrate Entra ID:

    If Entra ID supports Windows Hello Enterprise or other passwordless methods, follow Microsoft's guidelines for integration.

    This may involve configuring synchronization rules in Azure AD Connect to ensure synchronization of user identities between the local AD and Azure AD.

    Third, set up passwordless authentication for macOS devices

    Enable Platform Credential for macOS:

    Ensure that the Mac operating system is at least macOS 13 Ventura (macOS 14 Sonoma is recommended).

    Register the device with MDM and configure the SSO extension payload to support Platform Credential.

    Enable Platform Credential as a passkey and configure it in supported browsers such as Safari and Chrome.

    Integrate Entra ID:

    If Entra ID supports Platform Credential, follow Microsoft's guidelines for integration.

    This may involve configuring the relevant policies in Azure AD and ensuring that the Mac device is registered to Azure AD.

    Best regards

    NeuviJ

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.