使用 Microsoft Entra ID 实现无密码身份验证，支持 FIDO2 安全密钥、Windows Hello for Business、Microsoft Authenticator passkey 以及基于证书的身份验证，从而消除基于密码的攻击。适用于部署无密码登录、配置 FIDO2 passkey、强制执行抗网络钓鱼的 MFA，或设置 Microsoft Entra 身份验证方法策略的场景。
Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)
Deploying FIDO2 security keys or Windows Hello for Business across the enterprise
Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods
Implementing passkey support for hybrid or cloud-joined Windows devices
Reducing helpdesk costs from password reset requests
Do not use for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.
Prerequisites
Microsoft Entra ID P1 or P2 license (Azure AD Premium)
Windows 10/11 22H2+ for Windows Hello for Business deployment
FIDO2-compliant security keys (YubiKey 5 Series, Feitian BioPass, Google Titan)
Microsoft Authenticator app 6.8+ for passkey support on iOS 16+/Android 14+
Hybrid Azure AD join or Azure AD join configured for Windows devices
Conditional Access policies configured for authentication strength
Workflow
…
以下为摘要预览，完整内容请查看 GitHub 原文。
Implementing Passwordless Auth with Microsoft Entra
Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)
Deploying FIDO2 security keys or Windows Hello for Business across the enterprise
Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods
Implementing passkey support for hybrid or cloud-joined Windows devices
Reducing helpdesk costs from password reset requests
Do not use for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.
Prerequisites
Microsoft Entra ID P1 or P2 license (Azure AD Premium)
Windows 10/11 22H2+ for Windows Hello for Business deployment
FIDO2-compliant security keys (YubiKey 5 Series, Feitian BioPass, Google Titan)
Microsoft Authenticator app 6.8+ for passkey support on iOS 16+/Android 14+
Hybrid Azure AD join or Azure AD join configured for Windows devices
Conditional Access policies configured for authentication strength
