#Modern Workplace

Microsoft Entra makes passwordless registration easier, but what does this mean for Zero Trust? Let's discuss.. Microsoft recently  published  a message in the message center that covers details on Windows Hello for Business and macOS Platform SSO supporting standalone MFA factors. It is well established that Passwordless authentication is becoming the default approach for modern identity security. Windows Hello for Business (WHfB), passkeys, FIDO2 and macOS Platform SSO (PSSO) all provide stronger authentication while reducing our dependency on passwords. And with this new change, Microsoft has now made passwordless registration in Entra ID easier, including bringing register security information further into the conditional access model. However, this does raise an interesting question: If passwordless authentication is strong enough to authenticate the user, do we still need MFA? In my personal opinion, it is still necessary, but not necessarily in the way we traditionally ...

For the last couple of days, I have been working on securing my own tenant and as a result of this, I wanted to enable passkeys for all my test accounts. Passkeys (FIDO2) not only improves productivity and provide better security, but also make the authentication process seamless by eliminating the need for entering a username or password. This can be achieved through both FIDO2 security key and Microsoft Authenticator. Due to this fact, Microsoft and its partners are investing in both synced and device bound passkeys for work accounts. However, and during my own testing, enabling passkey on the user's side can go into a loop when trying to add a passkey in Microsoft Authenticator application. This may not be a case for every tenant, but if you have conditional access policies created that specifically leverage phishing-resistant authentication strength, then you will most likely run into this issue. Luckily there are some work arounds available and require further actions. In this...