Tech / IT Support · advanced
Passwordless Enterprise: Entra ID, Windows Hello for Business, and FIDO2
A Microsoft 365 tenant where no one types a password — Windows Hello for Business on managed devices, FIDO2 security keys and passkeys as the backup, Conditional Access policies that require phishing-resistant sign-in for sensitive apps, and a documented rollout plan with a break-glass procedure.
Project overview
Zero-trust identity is the top security priority in job postings, and passwordless is the concrete deliverable behind it. A tenant you can demo, with policies you can explain, is a senior-level artifact for an IT role and answers the question every security-conscious employer asks first.
Real-world use case
A regulated company must eliminate phishable credentials for everyone with access to finance systems. Executives use Windows Hello, contractors get FIDO2 keys, and Conditional Access blocks any sign-in that falls back to a password.
Tools and technologies
- Microsoft Entra ID
- Windows Hello for Business
- FIDO2 Security Keys / Passkeys
- Conditional Access
- Microsoft Intune
Skills you can demonstrate
Identity and Access Management, Zero Trust Architecture, Authentication Policy Design, Endpoint Security, Change Management
Build roadmap
- Prepare the tenant
A Microsoft 365 developer or trial tenant with a few test users, Intune-enrolled Windows 11 VMs, and two break-glass accounts excluded from every policy you will create. - Enable Windows Hello for Business
Configure it through Intune with cloud Kerberos trust. Enroll a device, set up Hello, and confirm sign-in to Windows and Microsoft 365 with no password. - Add FIDO2 keys and passkeys
Enable the authentication methods, register a security key and a phone passkey for a test user, and sign in with each on a device that has no Hello configured. - Build Conditional Access in report-only
Policies requiring phishing-resistant MFA for admins and a finance app group. Run in report-only mode and read the sign-in logs to see who would be blocked. - Enforce and test the edges
Turn the policies on. Test a password-only sign-in, a legacy client, a new device, and the break-glass account. Document every result. - Write the rollout plan
Phases, communications, success metrics, and the break-glass runbook. Present it as the document you would hand a CIO before go-live.
Ways to extend the project
Add Temporary Access Pass for onboarding without a password, and a Privileged Identity Management workflow so admin roles are activated just in time with approval.
How to showcase your work
- GitHub: Policy exports as JSON, the Intune configuration profiles, an architecture diagram, the rollout plan, and the break-glass runbook.
- LinkedIn: Record a sign-in to a finance app with a fingerprint, then the same sign-in attempt with a password being blocked by Conditional Access.
- Resume: Use the security vocabulary: "Designed and deployed passwordless authentication with Windows Hello for Business, FIDO2, and phishing-resistant Conditional Access."