EIDAUTH-008: Passwordless Authentication Readiness
- Platform
- Entra ID / M365
- Category
- Entra ID Authentication Methods & MFA
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Passwordless authentication eliminates passwords as an attack vector, removing the risk of credential theft, phishing, and password spraying. Organizations should assess their readiness to deploy passwordless methods such as FIDO2, Windows Hello for Business, and Microsoft Authenticator phone sign-in. This check evaluates current method adoption and identifies gaps preventing passwordless deployment.
Recommended value
Organization has a passwordless deployment plan with at least 50% of users capable of passwordless sign-in
Remediation
Review authentication method registrations to determine how many users have passwordless-capable methods enrolled. Enable FIDO2 and Microsoft Authenticator passwordless sign-in in the authentication methods policy. Create a phased rollout plan starting with privileged users and IT staff before expanding to the broader organization.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.AAD.3.1v1
- NIST SP 800-53
- IA-2(6)