2.1.2. Passwordless and Phishing-Resistant Methods

💡 First Principle: Phishing resistance comes from origin binding: the credential is a key pair whose signature is only valid for the genuine site's identity, so a perfect fake login page harvests nothing usable. Passwordless methods also remove the password as an attack surface entirely — nothing to guess, spray, or reuse.

Three passwordless families carry the exam. Microsoft Authenticator phone sign-in: user approves and matches a number; passwordless and convenient, but not origin-bound, so it's passwordless without being phishing-resistant — a distinction stems love. Passkeys (FIDO2): hardware security keys or synced passkeys in Authenticator; the private key signs a challenge bound to the origin; phishing-resistant, works across devices, the go-to answer for high-assurance users and admins. Windows Hello for Business: per-device key pair unlocked by PIN or biometric backed by TPM; phishing-resistant SSO into Entra from that device — the "the PIN never leaves the device" method. The biometric/PIN unlocks the local key; it is not sent anywhere.

Deployment notes that surface in questions: FIDO2 and the other methods are enabled and group-scoped in the authentication methods policy; key restriction policies can allow/block specific security key AAGUIDs; WHfB deployment models (cloud-only, hybrid) matter mainly at Expert depth, but know it provisions per device, so a user re-registers on each machine.

⚠️ Exam Trap: "Passwordless" ≠ "phishing-resistant." Authenticator phone sign-in is passwordless but does not satisfy a phishing-resistant MFA authentication strength — only passkeys/FIDO2, WHfB, and CBA do.

Reflection Question: Trace what a fake login.micros0ft.com page receives when a passkey user is lured to it — and why that differs from what it receives from an Authenticator-push user.