Users have registered their mobile devices to Azure Active Directory Users have registered for Azure AD MFA and SSPR PrerequisiteĬombined registration for Azure AD Multi-Factor Authentication (MFA) and self-service password reset (SSPR) is enabled The prerequisites are determined by your selected passwordless authentication methods. Microsoft Authenticator app and security keys To configure Authenticator app on device, or to enroll security key device for web or Windows 10 sign-in.Īs part of this deployment plan, we recommend that passwordless authentication be enabled for all privileged accounts. To implement and manage authentication methods. To implement combined registration experience. User Administrator or Global Administrator Here are the least privileged roles required for this deployment: Kiosks and shared computers ‎(Windows 10)Įnsure you meet the prerequisites before starting your passwordless deployment. Shared devices: tablets, and mobile devices Device typesĭedicated Windows 10 computers (version 1703 and later)ĭedicated Windows 10 computers (before version 1703)

The following table lists the passwordless authentication methods by device types. Consider your organizational needs, prerequisites, and the capabilities of each authentication method to select your passwordless authentication strategy. Microsoft's passwordless authentication methods enable many scenarios. You need administrator rights to access this wizard.

If you haven't yet determined the appropriate methods, see, then return to this article to continue planning for your selected methods. The Azure portal now has a passwordless methods wizard that will help you to select the appropriate method for each of your audiences. To create an offline version of this plan with all links, use your browsers print to pdf functionality.

Fido 2 key