[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFAAKB9VHTDGTRA97HXV85":3,"skill-same:01M6AFAAKB9VHTDGTRA97HXV85":130},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":89,"commitSha":90,"skillDirectory":91,"forksCount":92,"repositoryHtmlUrl":93,"repositoryHomepageUrl":94,"ownerHtmlUrl":95,"ownerBlogUrl":96,"ownerDescription":97,"updatedAt":98,"install":99,"resources":112},"01M6AFAAKB9VHTDGTRA97HXV85","implementing-passwordless-auth-with-microsoft-entra",null,"Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Use when deploying passwordless sign-in, configuring FIDO2 passkeys, enforcing phishing-resistant MFA, or setting Microsoft Entra authentication method policies.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-passwordless-auth-with-microsoft-entra\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing passwordless auth with microsoft entra","microsoft","auth","initial-access","phishing-resistant-MFA","Windows-Hello","Microsoft-Entra","passwordless","passkeys","FIDO2","t1098","t1566","security","t1078","authentication","entra id","windows","identity","hello","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-passwordless-auth-with-microsoft-entra\ndescription: 'Implements passwordless authentication using Microsoft Entra ID with\n  FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys,\n  and certificate-based authentication to eliminate password-based attacks. Use when\n  deploying passwordless sign-in, configuring FIDO2 passkeys, enforcing phishing-resistant\n  MFA, or setting Microsoft Entra authentication method policies.\n\n  '\ndomain: cybersecurity\nsubdomain: identity-access-management\ntags:\n- passwordless\n- FIDO2\n- passkeys\n- Microsoft-Entra\n- Windows-Hello\n- phishing-resistant-MFA\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-02\n- PR.AA-05\n- PR.AA-06\nmitre_attack:\n- T1078\n- T1110\n- T1556\n- T1098\n- T1566\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  techniques:\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n  - id: T1557\n    name: Adversary-in-the-Middle\n    tactic: initial-access\n    source: attack\n  - id: T1110.004\n    name: 'Brute Force:  Credential Stuffing'\n    tactic: initial-access\n    source: attack\n  - id: T1111\n    name: Multi-Factor Authentication Interception\n    tactic: initial-access\n    source: attack\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: F1004\n    name: Access with Stolen Session Cookie\n    tactic: initial-access\n    source: f3\n---\n\n# Implementing Passwordless Auth with Microsoft Entra\n\n## When to Use\n\n- Organization wants to eliminate password-based attacks (phishing, credential stuffing, brute force)\n- Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)\n- Deploying FIDO2 security keys or Windows Hello for Business across the enterprise\n- Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods\n- Implementing passkey support for hybrid or cloud-joined Windows devices\n- Reducing helpdesk costs from password reset requests\n\n**Do not use** for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.\n\n## Prerequisites\n\n- Microsoft Entra ID P1 or P2 license (Azure AD Premium)\n- Windows 10\u002F11 22H2+ for Windows Hello for Business deployment\n- FIDO2-compliant security keys (YubiKey 5 Series, Feitian BioPass, Google Titan)\n- Microsoft Authenticator app 6.8+ for passkey support on iOS 16+\u002FAndroid 14+\n- Hybrid Azure AD join or Azure AD join configured for Windows devices\n- Conditional Access policies configured for authentication strength\n\n## Workflow\n\n### Step 1: Configure Authentication Methods Policy\n\nEnable passwordless authentication methods in Microsoft Entra:\n\n```powershell\n# Connect to Microsoft Graph\nConnect-MgGraph -Scopes \"Policy.ReadWrite.AuthenticationMethod\", \"User.ReadWrite.All\"\n\n# Enable FIDO2 Security Key authentication method\n$fido2Policy = @{\n    \"@odata.type\" = \"#microsoft.graph.fido2AuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    isAttestationEnforced = $true\n    isSelfServiceRegistrationAllowed = $true\n    keyRestrictions = @{\n        isEnforced = $true\n        enforcementType = \"allow\"\n        aaGuids = @(\n            \"cb69481e-8ff7-4039-93ec-0a2729a154a8\",  # YubiKey 5 Series\n            \"ee882879-721c-4913-9775-3dfcce97072a\",  # YubiKey 5 NFC\n            \"fa2b99dc-9e39-4257-8f92-4a30d23c4118\",  # YubiKey 5C NFC\n            \"2fc0579f-8113-47ea-b116-bb5a8db9202a\",  # YubiKey Bio\n            \"73bb0cd4-e502-49b8-9c6f-b59445bf720b\"   # Google Titan\n        )\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"  # Or specific security group ID\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"fido2\" `\n    -BodyParameter $fido2Policy\n\n# Enable Microsoft Authenticator with passkey support\n$authenticatorPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    featureSettings = @{\n        displayAppInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        displayLocationInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        companionAppAllowedState = @{\n            state = \"enabled\"\n        }\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n            authenticationMode = \"any\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"microsoftAuthenticator\" `\n    -BodyParameter $authenticatorPolicy\n\n# Enable Windows Hello for Business\n$whfbPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsHelloForBusinessAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    securityKeyForSignIn = \"enabled\"\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"windowsHelloForBusiness\" `\n    -BodyParameter $whfbPolicy\n\nWrite-Host \"Passwordless authentication methods enabled successfully\"\n```\n\n### Step 2: Configure Authentication Strength Conditional Access\n\nCreate Conditional Access policies requiring phishing-resistant authentication:\n\n```powershell\n# Create custom authentication strength for phishing-resistant MFA\n$authStrength = @{\n    displayName = \"Phishing-Resistant Passwordless\"\n    description = \"Requires FIDO2, WHfB, or certificate-based authentication\"\n    allowedCombinations = @(\n        \"fido2\",\n        \"windowsHelloForBusiness\",\n        \"x509CertificateMultiFactor\"\n    )\n    requirementsSatisfied = \"mfa\"\n}\n$strengthPolicy = New-MgPolicyAuthenticationStrengthPolicy -BodyParameter $authStrength\n\n# Create Conditional Access policy requiring phishing-resistant auth\n$caPolicy = @{\n    displayName = \"Require Phishing-Resistant Auth for All Apps\"\n    state = \"enabledForReportingButNotEnforced\"  # Start in report-only\n    conditions = @{\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"Passwordless-Exclusion-Group\")\n        }\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create stricter policy for admin portals\n$adminPolicy = @{\n    displayName = \"Require Security Key for Admin Access\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{\n            includeRoles = @(\n                \"62e90394-69f5-4237-9190-012177145e10\",  # Global Admin\n                \"194ae4cb-b126-40b2-bd5b-6091b380977d\",  # Security Admin\n                \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\",  # SharePoint Admin\n                \"29232cdf-9323-42fd-ade2-1d097af3e4de\"   # Exchange Admin\n            )\n        }\n        applications = @{\n            includeApplications = @(\n                \"797f4846-ba00-4fd7-ba43-dac1f8f63013\",  # Azure Portal\n                \"00000006-0000-0ff1-ce00-000000000000\",  # Microsoft 365 Admin\n                \"0000000a-0000-0000-c000-000000000000\"   # Entra Admin Center\n            )\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy\n```\n\n### Step 3: Deploy Windows Hello for Business via Intune\n\nConfigure WHfB deployment through Microsoft Intune MDM:\n\n```powershell\n# Create Windows Hello for Business configuration profile in Intune\n$whfbProfile = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsIdentityProtectionConfiguration\"\n    displayName = \"WHfB - Enterprise Deployment\"\n    description = \"Windows Hello for Business configuration for all managed devices\"\n    useSecurityKeyForSignin = $true\n    windowsHelloForBusinessBlocked = $false\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    enhancedAntiSpoofingForFacialFeaturesEnabled = $true\n    pinRecoveryEnabled = $true\n    securityDeviceRequired = $true  # Require TPM\n    unlockWithBiometricsEnabled = $true\n    useCertificatesForOnPremisesAuthEnabled = $true  # For hybrid scenarios\n    # Cloud Kerberos Trust for hybrid join (recommended over key trust)\n    windowsHelloForBusinessAuthenticationMethod = \"cloudKerberosTrust\"\n}\n\n# Create the configuration profile\n$profile = New-MgDeviceManagementDeviceConfiguration -BodyParameter $whfbProfile\n\n# Assign to all Windows devices\n$assignment = @{\n    target = @{\n        \"@odata.type\" = \"#microsoft.graph.allDevicesAssignmentTarget\"\n    }\n}\nNew-MgDeviceManagementDeviceConfigurationAssignment `\n    -DeviceConfigurationId $profile.Id `\n    -BodyParameter $assignment\n\n# Configure Cloud Kerberos Trust (for hybrid Azure AD joined devices)\n# This eliminates the need for PKI infrastructure\n# Requires Azure AD Kerberos module\n\nImport-Module AzureADHybridAuthenticationManagement\n\n# Create Azure AD Kerberos Server object in on-premises AD\n$domain = \"corp.local\"\n$cloudCredential = Get-Credential -Message \"Enter Azure AD Global Admin credentials\"\n$domainCredential = Get-Credential -Message \"Enter on-premises Domain Admin credentials\"\n\nSet-AzureADKerberosServer `\n    -Domain $domain `\n    -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\n# Verify Kerberos Server object\nGet-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\nWrite-Host \"Cloud Kerberos Trust configured for hybrid WHfB deployment\"\n```\n\n### Step 4: Register FIDO2 Security Keys for Users\n\nImplement security key registration workflow:\n\n```powershell\n# Bulk FIDO2 security key registration via Temporary Access Pass\n# Step 1: Issue Temporary Access Pass for key registration\n\nfunction Issue-TemporaryAccessPass {\n    param(\n        [string]$UserId,\n        [int]$LifetimeMinutes = 60,\n        [bool]$IsUsableOnce = $true\n    )\n\n    $tap = @{\n        \"@odata.type\" = \"#microsoft.graph.temporaryAccessPassAuthenticationMethod\"\n        lifetimeInMinutes = $LifetimeMinutes\n        isUsableOnce = $IsUsableOnce\n    }\n\n    $result = New-MgUserAuthenticationTemporaryAccessPassMethod `\n        -UserId $UserId `\n        -BodyParameter $tap\n\n    return @{\n        UserId = $UserId\n        TemporaryAccessPass = $result.TemporaryAccessPass\n        ExpiresAt = $result.CreatedDateTime.AddMinutes($LifetimeMinutes)\n    }\n}\n\n# Bulk issue TAPs for security key registration event\n$registrationUsers = Import-Csv \"security_key_registration_list.csv\"\n\n$tapResults = foreach ($user in $registrationUsers) {\n    $tap = Issue-TemporaryAccessPass -UserId $user.UserPrincipalName\n    [PSCustomObject]@{\n        User = $user.UserPrincipalName\n        TAP = $tap.TemporaryAccessPass\n        Expires = $tap.ExpiresAt\n        KeySerial = $user.AssignedKeySerial\n    }\n}\n\n# Export TAPs for secure distribution to registration team\n$tapResults | Export-Csv \"tap_assignments.csv\" -NoTypeInformation\n\n# Monitor FIDO2 registration progress\nfunction Get-Fido2RegistrationStatus {\n    $allUsers = Get-MgUser -All -Property \"id,userPrincipalName,department\"\n\n    $registrationStatus = foreach ($user in $allUsers) {\n        $methods = Get-MgUserAuthenticationFido2Method -UserId $user.Id\n\n        [PSCustomObject]@{\n            UserPrincipalName = $user.UserPrincipalName\n            Department = $user.Department\n            Fido2KeyCount = $methods.Count\n            KeyModels = ($methods.Model -join \", \")\n            RegistrationDates = ($methods.CreatedDateTime -join \", \")\n            HasBackupKey = $methods.Count -ge 2\n        }\n    }\n\n    return $registrationStatus\n}\n\n$status = Get-Fido2RegistrationStatus\n$total = $status.Count\n$registered = ($status | Where-Object { $_.Fido2KeyCount -gt 0 }).Count\n$withBackup = ($status | Where-Object { $_.HasBackupKey }).Count\n\nWrite-Host \"FIDO2 Registration Progress\"\nWrite-Host \"  Total Users: $total\"\nWrite-Host \"  Registered:  $registered ($([math]::Round($registered\u002F$total*100,1))%)\"\nWrite-Host \"  With Backup: $withBackup ($([math]::Round($withBackup\u002F$total*100,1))%)\"\n```\n\n### Step 5: Disable Legacy Authentication Methods\n\nPhase out phishable authentication factors:\n\n```powershell\n# Disable SMS and voice call authentication\n$smsPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.smsAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"sms\" `\n    -BodyParameter $smsPolicy\n\n$voicePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.voiceAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"voice\" `\n    -BodyParameter $voicePolicy\n\n# Block legacy authentication protocols via Conditional Access\n$blockLegacyPolicy = @{\n    displayName = \"Block Legacy Authentication\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{ includeUsers = @(\"All\") }\n        applications = @{ includeApplications = @(\"All\") }\n        clientAppTypes = @(\n            \"exchangeActiveSync\",\n            \"other\"\n        )\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $blockLegacyPolicy\n\n# Audit users still using legacy authentication\n$legacyAuthReport = Get-MgAuditLogSignIn -Filter \"clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop clients'\" `\n    -Top 1000 | Group-Object userPrincipalName | Select-Object Count, Name |\n    Sort-Object Count -Descending\n\nWrite-Host \"Users with Legacy Auth (last 30 days):\"\n$legacyAuthReport | Format-Table -AutoSize\n```\n\n### Step 6: Monitor Passwordless Adoption Metrics\n\nTrack deployment progress and authentication method usage:\n\n```powershell\n# Generate passwordless adoption dashboard data\nfunction Get-PasswordlessAdoptionMetrics {\n    # Authentication method registration statistics\n    $registrationReport = Get-MgReportAuthenticationMethodUserRegistrationDetail -All\n\n    $metrics = @{\n        TotalUsers = $registrationReport.Count\n        PasswordlessCapable = ($registrationReport | Where-Object { $_.IsPasswordlessCapable }).Count\n        MfaRegistered = ($registrationReport | Where-Object { $_.IsMfaRegistered }).Count\n        Fido2Registered = ($registrationReport | Where-Object { \"fido2\" -in $_.MethodsRegistered }).Count\n        WhfbRegistered = ($registrationReport | Where-Object { \"windowsHelloForBusiness\" -in $_.MethodsRegistered }).Count\n        AuthenticatorRegistered = ($registrationReport | Where-Object { \"microsoftAuthenticator\" -in $_.MethodsRegistered }).Count\n        SmsOnly = ($registrationReport | Where-Object {\n            \"sms\" -in $_.MethodsRegistered -and\n            \"fido2\" -notin $_.MethodsRegistered -and\n            \"windowsHelloForBusiness\" -notin $_.MethodsRegistered\n        }).Count\n    }\n\n    # Authentication method usage from sign-in logs\n    $signInLogs = Get-MgAuditLogSignIn -Top 10000 -Filter \"createdDateTime ge $((Get-Date).AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ'))\"\n\n    $authMethodUsage = $signInLogs |\n        Group-Object { $_.AuthenticationMethodsUsed -join \",\" } |\n        Select-Object Count, Name | Sort-Object Count -Descending\n\n    return @{\n        Registration = $metrics\n        Usage = $authMethodUsage\n    }\n}\n\n$adoption = Get-PasswordlessAdoptionMetrics\n$reg = $adoption.Registration\n\nWrite-Host \"PASSWORDLESS ADOPTION REPORT\"\nWrite-Host \"============================\"\nWrite-Host \"Total Users:              $($reg.TotalUsers)\"\nWrite-Host \"Passwordless Capable:     $($reg.PasswordlessCapable) ($([math]::Round($reg.PasswordlessCapable\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"  FIDO2 Keys:             $($reg.Fido2Registered)\"\nWrite-Host \"  Windows Hello:          $($reg.WhfbRegistered)\"\nWrite-Host \"  Authenticator:          $($reg.AuthenticatorRegistered)\"\nWrite-Host \"MFA Registered:           $($reg.MfaRegistered) ($([math]::Round($reg.MfaRegistered\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"SMS Only (needs upgrade): $($reg.SmsOnly)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **FIDO2** | Fast Identity Online 2 standard enabling passwordless authentication using public-key cryptography bound to hardware authenticators or platform credentials |\n| **Passkey** | FIDO2 credential that can be device-bound (security key) or synced across devices, providing phishing-resistant authentication without passwords |\n| **Windows Hello for Business** | Windows platform authenticator using PIN, fingerprint, or facial recognition backed by TPM-protected asymmetric keys for passwordless sign-in |\n| **Cloud Kerberos Trust** | Deployment model for hybrid WHfB that uses Azure AD Kerberos to authenticate to on-premises resources without requiring PKI certificate infrastructure |\n| **Temporary Access Pass** | Time-limited passcode issued by admins enabling users to register passwordless methods or recover access when their primary method is unavailable |\n| **Authentication Strength** | Conditional Access capability in Microsoft Entra that specifies which authentication method combinations satisfy MFA requirements for a given policy |\n\n## Tools & Systems\n\n- **Microsoft Entra Admin Center**: Portal for configuring authentication methods, Conditional Access policies, and monitoring sign-in analytics\n- **Microsoft Intune**: MDM\u002FMAM platform for deploying Windows Hello for Business configuration profiles to managed devices\n- **Microsoft Graph API**: Programmatic interface for managing authentication methods, policies, and generating adoption reports\n- **FIDO2 Security Keys**: Hardware authenticators (YubiKey, Feitian, Google Titan) storing cryptographic credentials for phishing-resistant authentication\n\n## Common Scenarios\n\n### Scenario: Enterprise-Wide Passwordless Migration\n\n**Context**: Organization with 5,000 users plans to eliminate passwords within 12 months after experiencing a phishing attack that compromised 47 accounts. Current state: 60% use SMS MFA, 30% use Authenticator app, 10% have no MFA.\n\n**Approach**:\n1. Phase 1 (Month 1-2): Enable FIDO2 and WHfB authentication methods in report-only Conditional Access\n2. Phase 2 (Month 2-3): Deploy WHfB to all managed Windows devices via Intune with Cloud Kerberos Trust\n3. Phase 3 (Month 3-5): Distribute FIDO2 security keys to executives, IT admins, and finance (highest-risk users first)\n4. Phase 4 (Month 5-8): Enable Authenticator passkeys for mobile-primary users and field workers\n5. Phase 5 (Month 8-10): Switch Conditional Access from report-only to enforced for phishing-resistant auth\n6. Phase 6 (Month 10-12): Disable SMS and voice call methods, block legacy authentication protocols\n7. Ongoing: Monitor adoption metrics, issue TAPs for stragglers, maintain break-glass accounts\n\n**Pitfalls**:\n- Not deploying Cloud Kerberos Trust causes WHfB to fail for on-premises resource access in hybrid environments\n- Enforcing passwordless without ensuring all applications support modern authentication breaks access\n- Issuing only one security key per user without a backup creates lockout risk if the key is lost\n- Not configuring Temporary Access Pass as a recovery method before disabling password-based sign-in\n\n## Output Format\n\n```\nPASSWORDLESS AUTHENTICATION DEPLOYMENT REPORT\n================================================\nTenant:            corp.onmicrosoft.com\nUsers:             5,247\nDeployment Phase:  Phase 4 (Authenticator Passkeys)\n\nAUTHENTICATION METHOD REGISTRATION\nPasswordless Capable:    4,103 \u002F 5,247 (78.2%)\n  FIDO2 Security Keys:   892 (17.0%)\n  Windows Hello:          2,847 (54.3%)\n  Authenticator Passkey:  1,234 (23.5%)\n  Certificate-Based:      312 (5.9%)\n\nLEGACY METHOD STATUS\nSMS-Only Users:          387 (7.4%) -- migration in progress\nVoice-Only Users:        0 (disabled)\nNo MFA Users:            42 (0.8%) -- TAPs issued\n\nCONDITIONAL ACCESS\nPhishing-Resistant Policy:  ENFORCED (all users except exclusion group)\nLegacy Auth Block:          ENABLED\nAdmin Portal Policy:        SECURITY KEY REQUIRED\n\nSIGN-IN ANALYTICS (Last 30 Days)\nTotal Sign-Ins:          847,293\n  Passwordless:          623,891 (73.6%)\n  Password + MFA:        198,402 (23.4%)\n  Password Only:         0 (blocked)\n  Legacy Protocol:       0 (blocked)\n\nSECURITY IMPACT\nPhishing Incidents:      0 (down from 47 pre-deployment)\nPassword Reset Tickets:  -82% reduction\nAvg Sign-In Time:        8.2s (passwordless) vs 24.1s (password)\n```\n","# Implementing Passwordless Auth with Microsoft Entra\n\n## When to Use\n\n- Organization wants to eliminate password-based attacks (phishing, credential stuffing, brute force)\n- Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)\n- Deploying FIDO2 security keys or Windows Hello for Business across the enterprise\n- Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods\n- Implementing passkey support for hybrid or cloud-joined Windows devices\n- Reducing helpdesk costs from password reset requests\n\n**Do not use** for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.\n\n## Prerequisites\n\n- Microsoft Entra ID P1 or P2 license (Azure AD Premium)\n- Windows 10\u002F11 22H2+ for Windows Hello for Business deployment\n- FIDO2-compliant security keys (YubiKey 5 Series, Feitian BioPass, Google Titan)\n- Microsoft Authenticator app 6.8+ for passkey support on iOS 16+\u002FAndroid 14+\n- Hybrid Azure AD join or Azure AD join configured for Windows devices\n- Conditional Access policies configured for authentication strength\n\n## Workflow\n\n### Step 1: Configure Authentication Methods Policy\n\nEnable passwordless authentication methods in Microsoft Entra:\n\n```powershell\n# Connect to Microsoft Graph\nConnect-MgGraph -Scopes \"Policy.ReadWrite.AuthenticationMethod\", \"User.ReadWrite.All\"\n\n# Enable FIDO2 Security Key authentication method\n$fido2Policy = @{\n    \"@odata.type\" = \"#microsoft.graph.fido2AuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    isAttestationEnforced = $true\n    isSelfServiceRegistrationAllowed = $true\n    keyRestrictions = @{\n        isEnforced = $true\n        enforcementType = \"allow\"\n        aaGuids = @(\n            \"cb69481e-8ff7-4039-93ec-0a2729a154a8\",  # YubiKey 5 Series\n            \"ee882879-721c-4913-9775-3dfcce97072a\",  # YubiKey 5 NFC\n            \"fa2b99dc-9e39-4257-8f92-4a30d23c4118\",  # YubiKey 5C NFC\n            \"2fc0579f-8113-47ea-b116-bb5a8db9202a\",  # YubiKey Bio\n            \"73bb0cd4-e502-49b8-9c6f-b59445bf720b\"   # Google Titan\n        )\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"  # Or specific security group ID\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"fido2\" `\n    -BodyParameter $fido2Policy\n\n# Enable Microsoft Authenticator with passkey support\n$authenticatorPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    featureSettings = @{\n        displayAppInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        displayLocationInformationRequiredState = @{\n            state = \"enabled\"\n            includeTarget = @{\n                targetType = \"group\"\n                id = \"all_users\"\n            }\n        }\n        companionAppAllowedState = @{\n            state = \"enabled\"\n        }\n    }\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n            authenticationMode = \"any\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"microsoftAuthenticator\" `\n    -BodyParameter $authenticatorPolicy\n\n# Enable Windows Hello for Business\n$whfbPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsHelloForBusinessAuthenticationMethodConfiguration\"\n    state = \"enabled\"\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    securityKeyForSignIn = \"enabled\"\n    includeTargets = @(\n        @{\n            targetType = \"group\"\n            id = \"all_users\"\n        }\n    )\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"windowsHelloForBusiness\" `\n    -BodyParameter $whfbPolicy\n\nWrite-Host \"Passwordless authentication methods enabled successfully\"\n```\n\n### Step 2: Configure Authentication Strength Conditional Access\n\nCreate Conditional Access policies requiring phishing-resistant authentication:\n\n```powershell\n# Create custom authentication strength for phishing-resistant MFA\n$authStrength = @{\n    displayName = \"Phishing-Resistant Passwordless\"\n    description = \"Requires FIDO2, WHfB, or certificate-based authentication\"\n    allowedCombinations = @(\n        \"fido2\",\n        \"windowsHelloForBusiness\",\n        \"x509CertificateMultiFactor\"\n    )\n    requirementsSatisfied = \"mfa\"\n}\n$strengthPolicy = New-MgPolicyAuthenticationStrengthPolicy -BodyParameter $authStrength\n\n# Create Conditional Access policy requiring phishing-resistant auth\n$caPolicy = @{\n    displayName = \"Require Phishing-Resistant Auth for All Apps\"\n    state = \"enabledForReportingButNotEnforced\"  # Start in report-only\n    conditions = @{\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"Passwordless-Exclusion-Group\")\n        }\n        applications = @{\n            includeApplications = @(\"All\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy\n\n# Create stricter policy for admin portals\n$adminPolicy = @{\n    displayName = \"Require Security Key for Admin Access\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{\n            includeRoles = @(\n                \"62e90394-69f5-4237-9190-012177145e10\",  # Global Admin\n                \"194ae4cb-b126-40b2-bd5b-6091b380977d\",  # Security Admin\n                \"f28a1f50-f6e7-4571-818b-6a12f2af6b6c\",  # SharePoint Admin\n                \"29232cdf-9323-42fd-ade2-1d097af3e4de\"   # Exchange Admin\n            )\n        }\n        applications = @{\n            includeApplications = @(\n                \"797f4846-ba00-4fd7-ba43-dac1f8f63013\",  # Azure Portal\n                \"00000006-0000-0ff1-ce00-000000000000\",  # Microsoft 365 Admin\n                \"0000000a-0000-0000-c000-000000000000\"   # Entra Admin Center\n            )\n        }\n    }\n    grantControls = @{\n        operator = \"OR\"\n        authenticationStrength = @{\n            id = $strengthPolicy.Id\n        }\n    }\n    sessionControls = @{\n        signInFrequency = @{\n            value = 4\n            type = \"hours\"\n            isEnabled = $true\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy\n```\n\n### Step 3: Deploy Windows Hello for Business via Intune\n\nConfigure WHfB deployment through Microsoft Intune MDM:\n\n```powershell\n# Create Windows Hello for Business configuration profile in Intune\n$whfbProfile = @{\n    \"@odata.type\" = \"#microsoft.graph.windowsIdentityProtectionConfiguration\"\n    displayName = \"WHfB - Enterprise Deployment\"\n    description = \"Windows Hello for Business configuration for all managed devices\"\n    useSecurityKeyForSignin = $true\n    windowsHelloForBusinessBlocked = $false\n    pinMinimumLength = 6\n    pinMaximumLength = 127\n    pinUppercaseCharactersUsage = \"allowed\"\n    pinLowercaseCharactersUsage = \"allowed\"\n    pinSpecialCharactersUsage = \"allowed\"\n    enhancedAntiSpoofingForFacialFeaturesEnabled = $true\n    pinRecoveryEnabled = $true\n    securityDeviceRequired = $true  # Require TPM\n    unlockWithBiometricsEnabled = $true\n    useCertificatesForOnPremisesAuthEnabled = $true  # For hybrid scenarios\n    # Cloud Kerberos Trust for hybrid join (recommended over key trust)\n    windowsHelloForBusinessAuthenticationMethod = \"cloudKerberosTrust\"\n}\n\n# Create the configuration profile\n$profile = New-MgDeviceManagementDeviceConfiguration -BodyParameter $whfbProfile\n\n# Assign to all Windows devices\n$assignment = @{\n    target = @{\n        \"@odata.type\" = \"#microsoft.graph.allDevicesAssignmentTarget\"\n    }\n}\nNew-MgDeviceManagementDeviceConfigurationAssignment `\n    -DeviceConfigurationId $profile.Id `\n    -BodyParameter $assignment\n\n# Configure Cloud Kerberos Trust (for hybrid Azure AD joined devices)\n# This eliminates the need for PKI infrastructure\n# Requires Azure AD Kerberos module\n\nImport-Module AzureADHybridAuthenticationManagement\n\n# Create Azure AD Kerberos Server object in on-premises AD\n$domain = \"corp.local\"\n$cloudCredential = Get-Credential -Message \"Enter Azure AD Global Admin credentials\"\n$domainCredential = Get-Credential -Message \"Enter on-premises Domain Admin credentials\"\n\nSet-AzureADKerberosServer `\n    -Domain $domain `\n    -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\n# Verify Kerberos Server object\nGet-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCredential `\n    -DomainCredential $domainCredential\n\nWrite-Host \"Cloud Kerberos Trust configured for hybrid WHfB deployment\"\n```\n\n### Step 4: Register FIDO2 Security Keys for Users\n\nImplement security key registration workflow:\n\n```powershell\n# Bulk FIDO2 security key registration via Temporary Access Pass\n# Step 1: Issue Temporary Access Pass for key registration\n\nfunction Issue-TemporaryAccessPass {\n    param(\n        [string]$UserId,\n        [int]$LifetimeMinutes = 60,\n        [bool]$IsUsableOnce = $true\n    )\n\n    $tap = @{\n        \"@odata.type\" = \"#microsoft.graph.temporaryAccessPassAuthenticationMethod\"\n        lifetimeInMinutes = $LifetimeMinutes\n        isUsableOnce = $IsUsableOnce\n    }\n\n    $result = New-MgUserAuthenticationTemporaryAccessPassMethod `\n        -UserId $UserId `\n        -BodyParameter $tap\n\n    return @{\n        UserId = $UserId\n        TemporaryAccessPass = $result.TemporaryAccessPass\n        ExpiresAt = $result.CreatedDateTime.AddMinutes($LifetimeMinutes)\n    }\n}\n\n# Bulk issue TAPs for security key registration event\n$registrationUsers = Import-Csv \"security_key_registration_list.csv\"\n\n$tapResults = foreach ($user in $registrationUsers) {\n    $tap = Issue-TemporaryAccessPass -UserId $user.UserPrincipalName\n    [PSCustomObject]@{\n        User = $user.UserPrincipalName\n        TAP = $tap.TemporaryAccessPass\n        Expires = $tap.ExpiresAt\n        KeySerial = $user.AssignedKeySerial\n    }\n}\n\n# Export TAPs for secure distribution to registration team\n$tapResults | Export-Csv \"tap_assignments.csv\" -NoTypeInformation\n\n# Monitor FIDO2 registration progress\nfunction Get-Fido2RegistrationStatus {\n    $allUsers = Get-MgUser -All -Property \"id,userPrincipalName,department\"\n\n    $registrationStatus = foreach ($user in $allUsers) {\n        $methods = Get-MgUserAuthenticationFido2Method -UserId $user.Id\n\n        [PSCustomObject]@{\n            UserPrincipalName = $user.UserPrincipalName\n            Department = $user.Department\n            Fido2KeyCount = $methods.Count\n            KeyModels = ($methods.Model -join \", \")\n            RegistrationDates = ($methods.CreatedDateTime -join \", \")\n            HasBackupKey = $methods.Count -ge 2\n        }\n    }\n\n    return $registrationStatus\n}\n\n$status = Get-Fido2RegistrationStatus\n$total = $status.Count\n$registered = ($status | Where-Object { $_.Fido2KeyCount -gt 0 }).Count\n$withBackup = ($status | Where-Object { $_.HasBackupKey }).Count\n\nWrite-Host \"FIDO2 Registration Progress\"\nWrite-Host \"  Total Users: $total\"\nWrite-Host \"  Registered:  $registered ($([math]::Round($registered\u002F$total*100,1))%)\"\nWrite-Host \"  With Backup: $withBackup ($([math]::Round($withBackup\u002F$total*100,1))%)\"\n```\n\n### Step 5: Disable Legacy Authentication Methods\n\nPhase out phishable authentication factors:\n\n```powershell\n# Disable SMS and voice call authentication\n$smsPolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.smsAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"sms\" `\n    -BodyParameter $smsPolicy\n\n$voicePolicy = @{\n    \"@odata.type\" = \"#microsoft.graph.voiceAuthenticationMethodConfiguration\"\n    state = \"disabled\"\n}\nUpdate-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `\n    -AuthenticationMethodConfigurationId \"voice\" `\n    -BodyParameter $voicePolicy\n\n# Block legacy authentication protocols via Conditional Access\n$blockLegacyPolicy = @{\n    displayName = \"Block Legacy Authentication\"\n    state = \"enabled\"\n    conditions = @{\n        users = @{ includeUsers = @(\"All\") }\n        applications = @{ includeApplications = @(\"All\") }\n        clientAppTypes = @(\n            \"exchangeActiveSync\",\n            \"other\"\n        )\n    }\n    grantControls = @{\n        operator = \"OR\"\n        builtInControls = @(\"block\")\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $blockLegacyPolicy\n\n# Audit users still using legacy authentication\n$legacyAuthReport = Get-MgAuditLogSignIn -Filter \"clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop clients'\" `\n    -Top 1000 | Group-Object userPrincipalName | Select-Object Count, Name |\n    Sort-Object Count -Descending\n\nWrite-Host \"Users with Legacy Auth (last 30 days):\"\n$legacyAuthReport | Format-Table -AutoSize\n```\n\n### Step 6: Monitor Passwordless Adoption Metrics\n\nTrack deployment progress and authentication method usage:\n\n```powershell\n# Generate passwordless adoption dashboard data\nfunction Get-PasswordlessAdoptionMetrics {\n    # Authentication method registration statistics\n    $registrationReport = Get-MgReportAuthenticationMethodUserRegistrationDetail -All\n\n    $metrics = @{\n        TotalUsers = $registrationReport.Count\n        PasswordlessCapable = ($registrationReport | Where-Object { $_.IsPasswordlessCapable }).Count\n        MfaRegistered = ($registrationReport | Where-Object { $_.IsMfaRegistered }).Count\n        Fido2Registered = ($registrationReport | Where-Object { \"fido2\" -in $_.MethodsRegistered }).Count\n        WhfbRegistered = ($registrationReport | Where-Object { \"windowsHelloForBusiness\" -in $_.MethodsRegistered }).Count\n        AuthenticatorRegistered = ($registrationReport | Where-Object { \"microsoftAuthenticator\" -in $_.MethodsRegistered }).Count\n        SmsOnly = ($registrationReport | Where-Object {\n            \"sms\" -in $_.MethodsRegistered -and\n            \"fido2\" -notin $_.MethodsRegistered -and\n            \"windowsHelloForBusiness\" -notin $_.MethodsRegistered\n        }).Count\n    }\n\n    # Authentication method usage from sign-in logs\n    $signInLogs = Get-MgAuditLogSignIn -Top 10000 -Filter \"createdDateTime ge $((Get-Date).AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ'))\"\n\n    $authMethodUsage = $signInLogs |\n        Group-Object { $_.AuthenticationMethodsUsed -join \",\" } |\n        Select-Object Count, Name | Sort-Object Count -Descending\n\n    return @{\n        Registration = $metrics\n        Usage = $authMethodUsage\n    }\n}\n\n$adoption = Get-PasswordlessAdoptionMetrics\n$reg = $adoption.Registration\n\nWrite-Host \"PASSWORDLESS ADOPTION REPORT\"\nWrite-Host \"============================\"\nWrite-Host \"Total Users:              $($reg.TotalUsers)\"\nWrite-Host \"Passwordless Capable:     $($reg.PasswordlessCapable) ($([math]::Round($reg.PasswordlessCapable\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"  FIDO2 Keys:             $($reg.Fido2Registered)\"\nWrite-Host \"  Windows Hello:          $($reg.WhfbRegistered)\"\nWrite-Host \"  Authenticator:          $($reg.AuthenticatorRegistered)\"\nWrite-Host \"MFA Registered:           $($reg.MfaRegistered) ($([math]::Round($reg.MfaRegistered\u002F$reg.TotalUsers*100,1))%)\"\nWrite-Host \"SMS Only (needs upgrade): $($reg.SmsOnly)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **FIDO2** | Fast Identity Online 2 standard enabling passwordless authentication using public-key cryptography bound to hardware authenticators or platform credentials |\n| **Passkey** | FIDO2 credential that can be device-bound (security key) or synced across devices, providing phishing-resistant authentication without passwords |\n| **Windows Hello for Business** | Windows platform authenticator using PIN, fingerprint, or facial recognition backed by TPM-protected asymmetric keys for passwordless sign-in |\n| **Cloud Kerberos Trust** | Deployment model for hybrid WHfB that uses Azure AD Kerberos to authenticate to on-premises resources without requiring PKI certificate infrastructure |\n| **Temporary Access Pass** | Time-limited passcode issued by admins enabling users to register passwordless methods or recover access when their primary method is unavailable |\n| **Authentication Strength** | Conditional Access capability in Microsoft Entra that specifies which authentication method combinations satisfy MFA requirements for a given policy |\n\n## Tools & Systems\n\n- **Microsoft Entra Admin Center**: Portal for configuring authentication methods, Conditional Access policies, and monitoring sign-in analytics\n- **Microsoft Intune**: MDM\u002FMAM platform for deploying Windows Hello for Business configuration profiles to managed devices\n- **Microsoft Graph API**: Programmatic interface for managing authentication methods, policies, and generating adoption reports\n- **FIDO2 Security Keys**: Hardware authenticators (YubiKey, Feitian, Google Titan) storing cryptographic credentials for phishing-resistant authentication\n\n## Common Scenarios\n\n### Scenario: Enterprise-Wide Passwordless Migration\n\n**Context**: Organization with 5,000 users plans to eliminate passwords within 12 months after experiencing a phishing attack that compromised 47 accounts. Current state: 60% use SMS MFA, 30% use Authenticator app, 10% have no MFA.\n\n**Approach**:\n1. Phase 1 (Month 1-2): Enable FIDO2 and WHfB authentication methods in report-only Conditional Access\n2. Phase 2 (Month 2-3): Deploy WHfB to all managed Windows devices via Intune with Cloud Kerberos Trust\n3. Phase 3 (Month 3-5): Distribute FIDO2 security keys to executives, IT admins, and finance (highest-risk users first)\n4. Phase 4 (Month 5-8): Enable Authenticator passkeys for mobile-primary users and field workers\n5. Phase 5 (Month 8-10): Switch Conditional Access from report-only to enforced for phishing-resistant auth\n6. Phase 6 (Month 10-12): Disable SMS and voice call methods, block legacy authentication protocols\n7. Ongoing: Monitor adoption metrics, issue TAPs for stragglers, maintain break-glass accounts\n\n**Pitfalls**:\n- Not deploying Cloud Kerberos Trust causes WHfB to fail for on-premises resource access in hybrid environments\n- Enforcing passwordless without ensuring all applications support modern authentication breaks access\n- Issuing only one security key per user without a backup creates lockout risk if the key is lost\n- Not configuring Temporary Access Pass as a recovery method before disabling password-based sign-in\n\n## Output Format\n\n```\nPASSWORDLESS AUTHENTICATION DEPLOYMENT REPORT\n================================================\nTenant:            corp.onmicrosoft.com\nUsers:             5,247\nDeployment Phase:  Phase 4 (Authenticator Passkeys)\n\nAUTHENTICATION METHOD REGISTRATION\nPasswordless Capable:    4,103 \u002F 5,247 (78.2%)\n  FIDO2 Security Keys:   892 (17.0%)\n  Windows Hello:          2,847 (54.3%)\n  Authenticator Passkey:  1,234 (23.5%)\n  Certificate-Based:      312 (5.9%)\n\nLEGACY METHOD STATUS\nSMS-Only Users:          387 (7.4%) -- migration in progress\nVoice-Only Users:        0 (disabled)\nNo MFA Users:            42 (0.8%) -- TAPs issued\n\nCONDITIONAL ACCESS\nPhishing-Resistant Policy:  ENFORCED (all users except exclusion group)\nLegacy Auth Block:          ENABLED\nAdmin Portal Policy:        SECURITY KEY REQUIRED\n\nSIGN-IN ANALYTICS (Last 30 Days)\nTotal Sign-Ins:          847,293\n  Passwordless:          623,891 (73.6%)\n  Password + MFA:        198,402 (23.4%)\n  Password Only:         0 (blocked)\n  Legacy Protocol:       0 (blocked)\n\nSECURITY IMPACT\nPhishing Incidents:      0 (down from 47 pre-deployment)\nPassword Reset Tickets:  -82% reduction\nAvg Sign-In Time:        8.2s (passwordless) vs 24.1s (password)\n```\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"mitre_f3":52,"nist_csf":76,"subdomain":81,"description":82,"mitre_attack":83},[31,33,32,30,29,28],"mahipal","1.0",{"tactics":53,"version":54,"techniques":55},[27],"1.1",[56,60,63,66,69,73],{"id":57,"name":58,"source":59,"tactic":27},"T1660","Phishing","attack",{"id":61,"name":62,"source":59,"tactic":27},"T1557","Adversary-in-the-Middle",{"id":64,"name":65,"source":59,"tactic":27},"T1110.004","Brute Force:  Credential Stuffing",{"id":67,"name":68,"source":59,"tactic":27},"T1111","Multi-Factor Authentication Interception",{"id":70,"name":71,"source":72,"tactic":27},"F1006","Account Takeover","f3",{"id":74,"name":75,"source":72,"tactic":27},"F1004","Access with Stolen Session Cookie",[77,78,79,80],"PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06","identity-access-management","Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Use when deploying passwordless sign-in, configuring FIDO2 passkeys, enforcing phishing-resistant MFA, or setting Microsoft Entra authentication method policies.\n",[84,85,86,87,88],"T1078","T1110","T1556","T1098","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-passwordless-auth-with-microsoft-entra",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":100,"prompt":110,"zipAvailable":111},[101,104,107],{"tool":102,"command":103},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-passwordless-auth-with-microsoft-entra",{"tool":105,"command":106},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-passwordless-auth-with-microsoft-entra",{"tool":108,"command":109},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-passwordless-auth-with-microsoft-entra","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-passwordless-auth-with-microsoft-entra\u002FSKILL.md",true,[113,118,124],{"path":114,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-passwordless-auth-with-microsoft-entra\u002FLICENSE",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fapi-reference.md","REFERENCE","参考文档",2439,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-passwordless-auth-with-microsoft-entra\u002Freferences\u002Fapi-reference.md",{"path":125,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":128,"sourceHtmlUrl":129},"scripts\u002Fagent.py","SCRIPT","脚本",8584,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-passwordless-auth-with-microsoft-entra\u002Fscripts\u002Fagent.py",[131,156,180,207,232,259],{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,140,141,142,36,43,143,41,144,145,146,147,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[164,152,165,166,36,167,43,144,168,169,170,171,172,173,174,175,176,177,178,179],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":190,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[174,191,192,193,194,43,195,196,168,197,198,199,200,201,202,37,203,204,205,206],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[213],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[40,215,216,43,217,218,219,220,221,222,223,224,225,226,227,228,171,229,230,231],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[240,241,242,43,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[265],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[36,267,43,268,269,270,271,272,273,274,275,37,276,203,277,278,279,280,281,282],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]