Passwordless sign-in¶
Passwords are the weakest part of most sign-ins. Intune deploys the pieces that replace them: Windows Hello for Business on Windows, Platform single sign-on on Mac, and passkeys on phones and security keys. Entra ID handles the authentication methods themselves; Intune gets devices configured to use them.
Windows Hello for Business¶
Windows Hello for Business replaces the Windows password with a PIN or biometric backed by a key in the device's TPM. It counts as phishing-resistant multifactor authentication.
Choose one way to configure it¶
| Method | Applies | Best for |
|---|---|---|
| Tenant-wide enrollment policy (Devices > Enrollment > Windows > Windows Hello for Business) | Only at enrollment, to every device that enrolls | Simple tenants where every device should get the same settings |
| Account protection policy (Endpoint security > Account protection) or the settings catalog | At any time, to the groups you target | Most enterprises. Lets you pilot and change settings later. |
Many organizations set the tenant-wide policy to Not configured and use targeted policies instead, because changing the tenant-wide policy doesn't affect devices that are already enrolled.
Group Policy beats Intune for Windows Hello
If both Group Policy and Intune configure Windows Hello for Business, the Group Policy settings win and Intune's are ignored. Clean up old GPOs on hybrid joined devices before you rely on Intune.
Recommended settings¶
| Setting | Value |
|---|---|
| Use Windows Hello For Business | true |
| Require Security Device | true (TPM required) |
| Minimum PIN length | 6 or more |
| Allow biometrics | Yes, with enhanced anti-spoofing where available |
| Use Cloud Trust For On Prem Auth | Enabled, for hybrid environments (see below) |
Single sign-on to on-premises resources: cloud Kerberos trust¶
Entra joined devices often still need Kerberos tickets for file shares, printers and on-premises apps. Cloud Kerberos trust is the simplest way to make Windows Hello work for that:
- Create a Microsoft Entra Kerberos server object in each Active Directory domain (with the
AzureADHybridAuthenticationManagementPowerShell module). - Enable Use Cloud Trust For On Prem Auth in your Windows Hello policy.
- Make sure Use certificate for on-premises authentication is not configured. Certificate trust takes precedence over cloud Kerberos trust.
Cloud Kerberos trust needs no PKI and no certificate deployment. It replaces the older key trust and certificate trust models for most organizations, and it's a key step towards moving off hybrid join.
Other Windows settings worth knowing¶
- Enable Passwordless Experience (settings catalog, Windows 11): hides the password option at sign-in for Entra accounts, so users don't fall back to passwords.
- Web sign-in: lets users sign in to Windows with methods like a Temporary Access Pass, useful for first sign-in and recovery.
- Windows LAPS covers the local administrator account, which Windows Hello doesn't. See Windows LAPS.
macOS Platform SSO¶
Platform single sign-on (PSSO) lets users sign in to their Mac with Entra ID and gives single sign-on to apps and websites. It's the Mac equivalent of Windows Hello for Business plus Entra join.
Choose the authentication method¶
| Secure Enclave (recommended) | Smart card | Password | |
|---|---|---|---|
| Passwordless and phishing-resistant | |||
| Can be used as a passkey | |||
| Mac password synced with Entra ID | |||
| Supported on macOS 13 | |||
| Supported on macOS 14 and later |
With Secure Enclave, the local Mac password stays as it is (FileVault needs it at boot), and Touch ID unlocks the device and signs in to Entra ID with a hardware-bound key.
Create the policy¶
Create a settings catalog profile for macOS under Authentication > Extensible Single Sign On (SSO):
| Setting | Value |
|---|---|
| Extension Identifier | com.microsoft.CompanyPortalMac.ssoextension |
| Team Identifier | UBF8T346G9 |
| Type | Redirect |
| URLs | The Microsoft Entra sign-in URLs from Microsoft's Platform SSO guide |
| Platform SSO > Authentication Method (macOS 14+) | UserSecureEnclaveKey |
| Platform SSO > Use Shared Device Keys | Enabled |
| Platform SSO > Enable Registration During Setup | Enabled, to register during Setup Assistant on ADE Macs |
Rules of thumb:
- A Mac can only have one Platform SSO policy. Don't also deploy a separate Enterprise SSO plug-in policy.
- Company Portal must be installed, because it provides the SSO extension.
- Users must be allowed to join devices to Entra ID (Entra Device settings).
- Users need to sign in to their Edge profile for browser SSO, and Chrome needs the Microsoft Single Sign On extension.
Passkeys and security keys¶
Passkeys (FIDO2) are phishing-resistant credentials. Entra ID supports passkeys in Microsoft Authenticator on iOS and Android, on FIDO2 security keys, and on Macs through Platform SSO with Secure Enclave.
Intune's part:
- Deploy Microsoft Authenticator to managed phones.
- Deploy Company Portal to Macs, and enable it as a passkey provider through Platform SSO.
- Use Conditional Access authentication strengths to require phishing-resistant methods for admins first, then sensitive apps, then everyone.
Getting users started without a password¶
New users don't have a password-free credential yet. A Temporary Access Pass (TAP), issued in Entra ID, lets them sign in once and register Windows Hello, Platform SSO or a passkey. Combined with Autopilot and ADE, a new starter can go from box to passwordless without ever being told a password.