implementing-passwordless-auth-with-microsoft-entra

Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.

跳到安装

仓库: xalgord/xalgorix
最近来源活动: 2026年6月6日 16:41
检测到的 SKILL.md 语言: 英语
星标: 813
分支: 146

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/xalgord/xalgorix --skill implementing-passwordless-auth-with-microsoft-entra

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

查看这个仓库的全部 Skills

Implementing Passwordless Auth with Microsoft Entra

When to Use

Organization wants to eliminate password-based attacks (phishing, credential stuffing, brute force)

Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)

Deploying FIDO2 security keys or Windows Hello for Business across the enterprise

Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods

Implementing passkey support for hybrid or cloud-joined Windows devices

Reducing helpdesk costs from password reset requests

Do not use for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.

Common Misconfigurations & Verification

Entra "passwordless" frequently coexists with phishable fallbacks that attackers simply pivot to:

Conditional Access stuck in report-only: the phishing-resistant policy is built but state = enabledForReportingButNotEnforced, so passwords still work. Confirm state = enabled for the auth-strength policy and that admin roles map to the Phishing-resistant MFA built-in strength (FIDO2/WHfB/x509), not just "MFA."

SMS/voice/TOTP still enabled as fallback: registering a passkey does nothing if a phished SMS code grants the same access. Verify with Graph: GET /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/sms (and voice) return state = disabled, and that no legacy per-user MFA leaves SMS registered.

FIDO2 attestation/key restrictions off: isAttestationEnforced = false or empty aaGuids lets any (including virtual) authenticator register. Confirm attestation is enforced and the AAGUID allow-list matches approved YubiKey/Titan models.

Legacy auth not blocked: verify a Conditional Access policy blocks exchangeActiveSync/other client app types, then check sign-in logs (clientAppUsed) show zero successful legacy-protocol logins.

Single key, no backup, TAP left long-lived: confirm ≥2 FIDO2 methods per privileged user and that Temporary Access Pass is isUsableOnce / short lifetime, not a standing password substitute.

Break-glass accounts wrongly forced into passwordless: confirm excluded emergency accounts exist, are monitored, and have an alert on every sign-in.

Implementing Passwordless Auth with Microsoft Entra

When to Use

Organization wants to eliminate password-based attacks (phishing, credential stuffing, brute force)

Regulatory or internal mandate requires phishing-resistant MFA (Executive Order 14028, CISA guidance)

Deploying FIDO2 security keys or Windows Hello for Business across the enterprise

Migrating from legacy MFA (SMS, phone call) to phishing-resistant authentication methods

Implementing passkey support for hybrid or cloud-joined Windows devices

Reducing helpdesk costs from password reset requests

Do not use for environments that cannot support modern authentication protocols; legacy applications using NTLM or basic authentication must be migrated first.

Common Misconfigurations & Verification

Entra "passwordless" frequently coexists with phishable fallbacks that attackers simply pivot to:

Single key, no backup, TAP left long-lived: confirm ≥2 FIDO2 methods per privileged user and that Temporary Access Pass is isUsableOnce / short lifetime, not a standing password substitute.

Break-glass accounts wrongly forced into passwordless: confirm excluded emergency accounts exist, are monitored, and have an alert on every sign-in.

# Connect to Microsoft Graph Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod", "User.ReadWrite.All" # Enable FIDO2 Security Key authentication method $fido2Policy = @{ "@odata.type" = "#microsoft.graph.fido2AuthenticationMethodConfiguration" state = "enabled" isAttestationEnforced = $true isSelfServiceRegistrationAllowed = $true keyRestrictions = @{ isEnforced = $true enforcementType = "allow" aaGuids = @( "cb69481e-8ff7-4039-93ec-0a2729a154a8", # YubiKey 5 Series "ee882879-721c-4913-9775-3dfcce97072a", # YubiKey 5 NFC "fa2b99dc-9e39-4257-8f92-4a30d23c4118", # YubiKey 5C NFC "2fc0579f-8113-47ea-b116-bb5a8db9202a", # YubiKey Bio "73bb0cd4-e502-49b8-9c6f-b59445bf720b" # Google Titan ) } includeTargets = @( @{ targetType = "group" id = "all_users" # Or specific security group ID } ) } Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration ` -AuthenticationMethodConfigurationId "fido2" ` -BodyParameter $fido2Policy # Enable Microsoft Authenticator with passkey support $authenticatorPolicy = @{ "@odata.type" = "#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration" state = "enabled" featureSettings = @{ displayAppInformationRequiredState = @{ state = "enabled" includeTarget = @{ targetType = "group" id = "all_users" } } displayLocationInformationRequiredState = @{ state = "enabled" includeTarget = @{ targetType = "group" id = "all_users" } } companionAppAllowedState = @{ state = "enabled" } } includeTargets = @( @{ targetType = "group" id = "all_users" authenticationMode = "any" } ) } Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration ` -AuthenticationMethodConfigurationId "microsoftAuthenticator" ` -BodyParameter $authenticatorPolicy # Enable Windows Hello for Business $whfbPolicy = @{ "@odata.type" = "#microsoft.graph.windowsHelloForBusinessAuthenticationMethodConfiguration" state = "enabled" pinMinimumLength = 6 pinMaximumLength = 127 pinLowercaseCharactersUsage = "allowed" pinUppercaseCharactersUsage = "allowed" pinSpecialCharactersUsage = "allowed" securityKeyForSignIn = "enabled" includeTargets = @( @{ targetType = "group" id = "all_users" } ) } Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration ` -AuthenticationMethodConfigurationId "windowsHelloForBusiness" ` -BodyParameter $whfbPolicy Write-Host "Passwordless authentication methods enabled successfully"

# Create custom authentication strength for phishing-resistant MFA $authStrength = @{ displayName = "Phishing-Resistant Passwordless" description = "Requires FIDO2, WHfB, or certificate-based authentication" allowedCombinations = @( "fido2", "windowsHelloForBusiness", "x509CertificateMultiFactor" ) requirementsSatisfied = "mfa" } $strengthPolicy = New-MgPolicyAuthenticationStrengthPolicy -BodyParameter $authStrength # Create Conditional Access policy requiring phishing-resistant auth $caPolicy = @{ displayName = "Require Phishing-Resistant Auth for All Apps" state = "enabledForReportingButNotEnforced" # Start in report-only conditions = @{ users = @{ includeUsers = @("All") excludeGroups = @("Passwordless-Exclusion-Group") } applications = @{ includeApplications = @("All") } clientAppTypes = @("browser", "mobileAppsAndDesktopClients") } grantControls = @{ operator = "OR" authenticationStrength = @{ id = $strengthPolicy.Id } } } New-MgIdentityConditionalAccessPolicy -BodyParameter $caPolicy # Create stricter policy for admin portals $adminPolicy = @{ displayName = "Require Security Key for Admin Access" state = "enabled" conditions = @{ users = @{ includeRoles = @( "62e90394-69f5-4237-9190-012177145e10", # Global Admin "194ae4cb-b126-40b2-bd5b-6091b380977d", # Security Admin "f28a1f50-f6e7-4571-818b-6a12f2af6b6c", # SharePoint Admin "29232cdf-9323-42fd-ade2-1d097af3e4de" # Exchange Admin ) } applications = @{ includeApplications = @( "797f4846-ba00-4fd7-ba43-dac1f8f63013", # Azure Portal "00000006-0000-0ff1-ce00-000000000000", # Microsoft 365 Admin "0000000a-0000-0000-c000-000000000000" # Entra Admin Center ) } } grantControls = @{ operator = "OR" authenticationStrength = @{ id = $strengthPolicy.Id } } sessionControls = @{ signInFrequency = @{ value = 4 type = "hours" isEnabled = $true } } } New-MgIdentityConditionalAccessPolicy -BodyParameter $adminPolicy

# Create Windows Hello for Business configuration profile in Intune $whfbProfile = @{ "@odata.type" = "#microsoft.graph.windowsIdentityProtectionConfiguration" displayName = "WHfB - Enterprise Deployment" description = "Windows Hello for Business configuration for all managed devices" useSecurityKeyForSignin = $true windowsHelloForBusinessBlocked = $false pinMinimumLength = 6 pinMaximumLength = 127 pinUppercaseCharactersUsage = "allowed" pinLowercaseCharactersUsage = "allowed" pinSpecialCharactersUsage = "allowed" enhancedAntiSpoofingForFacialFeaturesEnabled = $true pinRecoveryEnabled = $true securityDeviceRequired = $true # Require TPM unlockWithBiometricsEnabled = $true useCertificatesForOnPremisesAuthEnabled = $true # For hybrid scenarios # Cloud Kerberos Trust for hybrid join (recommended over key trust) windowsHelloForBusinessAuthenticationMethod = "cloudKerberosTrust" } # Create the configuration profile $profile = New-MgDeviceManagementDeviceConfiguration -BodyParameter $whfbProfile # Assign to all Windows devices $assignment = @{ target = @{ "@odata.type" = "#microsoft.graph.allDevicesAssignmentTarget" } } New-MgDeviceManagementDeviceConfigurationAssignment ` -DeviceConfigurationId $profile.Id ` -BodyParameter $assignment # Configure Cloud Kerberos Trust (for hybrid Azure AD joined devices) # This eliminates the need for PKI infrastructure # Requires Azure AD Kerberos module Import-Module AzureADHybridAuthenticationManagement # Create Azure AD Kerberos Server object in on-premises AD $domain = "corp.local" $cloudCredential = Get-Credential -Message "Enter Azure AD Global Admin credentials" $domainCredential = Get-Credential -Message "Enter on-premises Domain Admin credentials" Set-AzureADKerberosServer ` -Domain $domain ` -CloudCredential $cloudCredential ` -DomainCredential $domainCredential # Verify Kerberos Server object Get-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCredential ` -DomainCredential $domainCredential Write-Host "Cloud Kerberos Trust configured for hybrid WHfB deployment"

# Bulk FIDO2 security key registration via Temporary Access Pass # Step 1: Issue Temporary Access Pass for key registration function Issue-TemporaryAccessPass { param( [string]$UserId, [int]$LifetimeMinutes = 60, [bool]$IsUsableOnce = $true ) $tap = @{ "@odata.type" = "#microsoft.graph.temporaryAccessPassAuthenticationMethod" lifetimeInMinutes = $LifetimeMinutes isUsableOnce = $IsUsableOnce } $result = New-MgUserAuthenticationTemporaryAccessPassMethod ` -UserId $UserId ` -BodyParameter $tap return @{ UserId = $UserId TemporaryAccessPass = $result.TemporaryAccessPass ExpiresAt = $result.CreatedDateTime.AddMinutes($LifetimeMinutes) } } # Bulk issue TAPs for security key registration event $registrationUsers = Import-Csv "security_key_registration_list.csv" $tapResults = foreach ($user in $registrationUsers) { $tap = Issue-TemporaryAccessPass -UserId $user.UserPrincipalName [PSCustomObject]@{ User = $user.UserPrincipalName TAP = $tap.TemporaryAccessPass Expires = $tap.ExpiresAt KeySerial = $user.AssignedKeySerial } } # Export TAPs for secure distribution to registration team $tapResults | Export-Csv "tap_assignments.csv" -NoTypeInformation # Monitor FIDO2 registration progress function Get-Fido2RegistrationStatus { $allUsers = Get-MgUser -All -Property "id,userPrincipalName,department" $registrationStatus = foreach ($user in $allUsers) { $methods = Get-MgUserAuthenticationFido2Method -UserId $user.Id [PSCustomObject]@{ UserPrincipalName = $user.UserPrincipalName Department = $user.Department Fido2KeyCount = $methods.Count KeyModels = ($methods.Model -join ", ") RegistrationDates = ($methods.CreatedDateTime -join ", ") HasBackupKey = $methods.Count -ge 2 } } return $registrationStatus } $status = Get-Fido2RegistrationStatus $total = $status.Count $registered = ($status | Where-Object { $_.Fido2KeyCount -gt 0 }).Count $withBackup = ($status | Where-Object { $_.HasBackupKey }).Count Write-Host "FIDO2 Registration Progress" Write-Host " Total Users: $total" Write-Host " Registered: $registered ($([math]::Round($registered/$total*100,1))%)" Write-Host " With Backup: $withBackup ($([math]::Round($withBackup/$total*100,1))%)"

# Generate passwordless adoption dashboard data function Get-PasswordlessAdoptionMetrics { # Authentication method registration statistics $registrationReport = Get-MgReportAuthenticationMethodUserRegistrationDetail -All $metrics = @{ TotalUsers = $registrationReport.Count PasswordlessCapable = ($registrationReport | Where-Object { $_.IsPasswordlessCapable }).Count MfaRegistered = ($registrationReport | Where-Object { $_.IsMfaRegistered }).Count Fido2Registered = ($registrationReport | Where-Object { "fido2" -in $_.MethodsRegistered }).Count WhfbRegistered = ($registrationReport | Where-Object { "windowsHelloForBusiness" -in $_.MethodsRegistered }).Count AuthenticatorRegistered = ($registrationReport | Where-Object { "microsoftAuthenticator" -in $_.MethodsRegistered }).Count SmsOnly = ($registrationReport | Where-Object { "sms" -in $_.MethodsRegistered -and "fido2" -notin $_.MethodsRegistered -and "windowsHelloForBusiness" -notin $_.MethodsRegistered }).Count } # Authentication method usage from sign-in logs $signInLogs = Get-MgAuditLogSignIn -Top 10000 -Filter "createdDateTime ge $((Get-Date).AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ'))" $authMethodUsage = $signInLogs | Group-Object { $_.AuthenticationMethodsUsed -join "," } | Select-Object Count, Name | Sort-Object Count -Descending return @{ Registration = $metrics Usage = $authMethodUsage } } $adoption = Get-PasswordlessAdoptionMetrics $reg = $adoption.Registration Write-Host "PASSWORDLESS ADOPTION REPORT" Write-Host "============================" Write-Host "Total Users: $($reg.TotalUsers)" Write-Host "Passwordless Capable: $($reg.PasswordlessCapable) ($([math]::Round($reg.PasswordlessCapable/$reg.TotalUsers*100,1))%)" Write-Host " FIDO2 Keys: $($reg.Fido2Registered)" Write-Host " Windows Hello: $($reg.WhfbRegistered)" Write-Host " Authenticator: $($reg.AuthenticatorRegistered)" Write-Host "MFA Registered: $($reg.MfaRegistered) ($([math]::Round($reg.MfaRegistered/$reg.TotalUsers*100,1))%)" Write-Host "SMS Only (needs upgrade): $($reg.SmsOnly)"

name	implementing-passwordless-auth-with-microsoft-entra
description	Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.
domain	cybersecurity
subdomain	identity-access-management
tags	["passwordless","FIDO2","passkeys","Microsoft-Entra","Windows-Hello","phishing-resistant-MFA"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]

name	implementing-passwordless-auth-with-microsoft-entra
description	Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Activates for requests involving passwordless deployment, FIDO2 passkey configuration, phishing-resistant MFA, or Microsoft Entra authentication method policies.
domain	cybersecurity
subdomain	identity-access-management
tags	["passwordless","FIDO2","passkeys","Microsoft-Entra","Windows-Hello","phishing-resistant-MFA"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]

Term	Definition
FIDO2	Fast Identity Online 2 standard enabling passwordless authentication using public-key cryptography bound to hardware authenticators or platform credentials
Passkey	FIDO2 credential that can be device-bound (security key) or synced across devices, providing phishing-resistant authentication without passwords
Windows Hello for Business	Windows platform authenticator using PIN, fingerprint, or facial recognition backed by TPM-protected asymmetric keys for passwordless sign-in
Cloud Kerberos Trust	Deployment model for hybrid WHfB that uses Azure AD Kerberos to authenticate to on-premises resources without requiring PKI certificate infrastructure
Temporary Access Pass	Time-limited passcode issued by admins enabling users to register passwordless methods or recover access when their primary method is unavailable
Authentication Strength	Conditional Access capability in Microsoft Entra that specifies which authentication method combinations satisfy MFA requirements for a given policy

implementing-passwordless-auth-with-microsoft-entra

安装方式

检查来源文件