Passwordless stopped being a project and became a moving target. Methods you rolled out two years ago are on sunset paths, new ones arrived without a clean migration story, and the honest answer to "are we passwordless yet" is usually "for some people, on some devices, for some apps."

This session is a working map of the current state in Microsoft Entra ID and what to build against next. We cover what is production ready today (passkeys in Microsoft Authenticator, FIDO2 security keys, Windows Hello for Business, certificate-based authentication, Temporary Access Pass), what is being retired and on what timeline, and which preview features are worth designing around versus waiting out.

The hard parts get most of the time: bootstrapping a credential for a new hire who has nothing yet, frontline and shared-device scenarios where nobody has a personal phone, legacy applications that still insist on a password field, break-glass accounts, and the Conditional Access authentication strength policies that make any of this enforceable rather than aspirational. We walk through real rollout architectures, where they broke, and what the recovery path looked like.

You leave with a method inventory mapped to your own user segments, a sequencing plan that does not strand anyone mid-migration, and enough detail on authentication strength and registration policy to write the Conditional Access rules on Monday.

Level 200-300
45 minutes + questions

After this session, participants can:
Map available and sunsetting authentication methods to their own user
segments, including frontline and shared-device workers.
Design a credential bootstrap and recovery path using Temporary Access Pass
and authentication strength policies.
Enforce phishing-resistant authentication through Conditional Access
instead of relying on voluntary adoption.