Chapter 8: Planning and Managing Password-Less Authentication Methods

The previous chapter covered protecting and managing our identity and access with multi-factor authentication, password protection, and self-service password resets. In this chapter, we are going to take modern authentication a step further by discussing how we can utilize passwordless authentication methods.

In this chapter, we're going to cover the following main topics:

• Administering authentication methods (FIDO2/passwordless)
• Implementing an authentication solution based on Windows Hello for Business
• Implementing an authentication solution with the Microsoft authenticator app

Technical requirements

In this chapter, we will continue to explore configuring a tenant for use with Microsoft 365 and Azure. There will be exercises where you will require access to Azure Active Directory. If you have not created the trial licenses for Microsoft 365 yet, please follow the instructions provided in Chapter 1, Preparing for Your Microsoft Exam.

Administering authentication methods (FIDO2/passwordless)

As we continue through this book, we will expand on the ways that Azure Active Directory provides a modern approach to identity and access management. As we continue to migrate to more cloud applications and hybrid infrastructures, companies can also migrate to these newer modern authentication methods. In Chapter 7, Planning and Implementing Azure Multi-Factor Authentication and Self-Service Password Reset, we covered how MFA can provide an additional layer of verification to protect against the inherent insecurity of simply using a password for authentication. As identity and access management continues to evolve, additional solutions have become available to move away from the use of passwords. The following sections will discuss those options and how they can be used within your company's identity and access management infrastructure.

Modern authentication for identity and access management

In Chapter 2, Defining...

Implementing an authentication solution based on Windows Hello for Business

In the previous section on passwordless authentication, we discussed how Windows Hello can be used by Windows 10 users for authentication by utilizing facial recognition. Windows Hello for Business allows the company to require users of Windows 10 devices to use this as the required authentication and monitor users. In this section, you will learn how to implement Windows Hello for Business as the authentication solution. Windows Hello for Business is configured within the Windows Active Directory domain controller, not Azure AD.

To implement Windows Hello for Business, multiple security groups are required. These security groups are the KeyCredential Admins security group and the Windows Hello for Business Users security group. If you are in a hybrid architecture with Windows Server 2016 domain controllers, the KeyCredential Admins group is created when you install the domain controller.

If your hybrid...

Implementing an authentication solution with the Microsoft Authenticator app

Where Windows Hello for Business and FIDO/2 are passwordless authentication options for Windows 10, the Microsoft Authenticator app provides more flexibility across all apps and devices. As a recap, Windows Hello for Business utilizes biometric facial recognition as the primary factor for verification, while FIDO/2 utilizes a USB key that the user has in their possession to authenticate with a private encrypted key. The requirement of providing all users or a group of users with a separate FIDO/2 token device adds additional cost to the passwordless implementation. Authenticator app authentication utilizes something that most likely all users have: a smartphone. Let's go through the steps to set up the Microsoft Authenticator app for passwordless authentication:

1. Log into https://portal.azure.com.
2. Navigate to Azure Active Directory from the search bar:

Figure 8.14...

Summary

In this chapter, we described the next steps in identity protection with passwordless authentication. We discussed the different options that Microsoft provides to allow users to move away from the use of passwords as the primary authentication method. Then, we learned how those options can be configured and utilized within Azure AD and hybrid architectures. In the next chapter, Chapter 9, Planning, Implementing, and Administering Conditional Access and Azure Identity Protection, we will discuss advanced solutions that protect a person's identity and enforce the zero trust model with conditional access policies and Azure Identity Protection.