OVERVIEW
Zero Trust starts with secure access
Transform the security of your entry points with best-in-class passwordless authentication technology from Microsoft.
- Take advantage of innovations in passwordless industry standards from Microsoft, a founding member of the FIDO2 Alliance.
- Increase productivity by taking password policies and reset support tickets off your team’s to-do list.
- Replace passwords with your choice of convenient and secure options for passwordless authentication.
CAPABILITIES
Manage passwordless authentication with Microsoft Entra ID
Use Microsoft Entra ID to manage Windows Hello for Business, the Microsoft Authenticator app, and FIDO2 security keys for all of your users.
Product
Windows Hello for Business
Enable safer sign-ins with biometric authentication for Windows devices.
Product
Microsoft Authenticator app
Empower employees and partners to verify their identities with biometrics or a PIN on their mobile device.
Product
FIDO2 security keys
Replace usernames and passwords with an external security key or a platform key built into a device.
Product
Passkey
Sign in with a passkey and perform phishing-resistant authentication using Microsoft Authenticator.
PLANS AND PRICING
Get started with passwordless authentication in Microsoft Entra ID
Microsoft Entra ID P1
Secure access for any identity with a market-leading cloud identity and access management solution.
$6.00
user/month, paid yearly
(Annual subscription—auto renews)1
Secure access for any identity with a market-leading cloud identity and access management solution.
(Annual subscription—auto renews)1
This product is not available in your market.
Entra ID PI capabilities:
- Authentication, single sign-on, and application access
- Employee self-service
- Administration and hybrid identity
- Multifactor authentication
- Passwordless authentication
- Conditional access
- Event logging and reporting
- Advanced security and usage reports
- Verifiable credentials issuance and verification
Microsoft Entra ID P2
Get comprehensive identity protection and risk detection, adaptive risk-based access controls, and privileged access for critical resources.
$9.00
user/month, paid yearly
(Annual subscription—auto renews)1
Get comprehensive identity protection and risk detection, adaptive risk-based access controls, and privileged access for critical resources.
(Annual subscription—auto renews)1
This product is not available in your market.
Includes all capabilities in Entra ID P1 plus:
- Microsoft Entra ID Protection
- Risk-based conditional access
- Privileged identity management
- Basic entitlement management
- Basic access reviews
RESOURCES
More on passwordless authentication
Get started
Get started with Microsoft Entra ID
Strengthen your identity security with passwordless authentication capabilities built into Microsoft Entra ID.
Frequently asked questions
- Passwordless authentication is a way to sign in without using a password. Instead, users verify their identity using methods such as biometrics (face or fingerprint), a device-based approval, or a hardware security key. This can help reduce reliance on passwords, which are often targeted through phishing and credential theft.
- Common passwordless options include:
- Passkeys (a modern sign-in method designed to be resistant to phishing)
- Biometric sign-in on supported devices (face or fingerprint)
- Device-based sign-in (for example, approving a sign-in on a trusted device)
- Hardware security keys (useful for privileged roles or users who need an alternative to
phones)
- Passwords can be stolen, guessed, reused, or captured through phishing. Passwordless methods reduce dependence on a shared secret (the password) and typically tie sign-in to a trusted device, biometric verification, or a hardware key. This makes it harder for attackers to sign in using only stolen credentials—especially in common phishing scenarios.
- Not necessarily. Many passwordless methods work with devices people already use, such as phones and modern laptops with built-in biometric capabilities. Some organizations choose to provide hardware security keys for certain users—such as administrators, high- risk roles, orenvironments where phones aren’t practical—but it’s not required for every user.
- A strong passwordless approach includes a plan for lost devices. Organizations typically address this by:
- Allowing a backup sign-in method
- Using secure identity recovery processes
- Establishing clear steps for reporting lost devices and restoring access
- Yes. Many organizations roll out passwordless in phases to minimize disruption. A practical approach is to start with:
- A pilot group (such as IT or a small set of users)
- Broader deployment by team or role
- Organization-wide rollout with simple guidance and support resources
- Passwordless adoption is easiest when setup is simple and employees know what to expect.
Helpful practices include:
- Clear, short setup instructions and a quick “first sign-in” walkthrough
- Guidance on what to do if users receive an unexpected sign-in prompt
- A backup option for access so users feel confident switching
- Simple internal help content for common questions and recovery steps
- [1]Cancellation policies for paid subscriptions may vary based on factors such as your customer status, your product, and your domain selections on Microsoft. You may cancel your subscription at any time in the Microsoft 365 admin center. Certain subscriptions may incur a cancellation fee. Learn how to cancel your Microsoft 365 subscription. When a subscription is canceled, all associated data will be deleted. Learn more about data retention, deletion, and destruction in Microsoft 365.
Follow Microsoft Security