Step by step process of Passwordless Authentication based on Scenarios.
Pre-Requisites
User device needs to have Microsoft Authenticator, with push notification allowed as a verification method.
For Android, the device that runs Microsoft Authenticator must be registered with Individual user.
For iOS, the device must be registered with each tenant.
Step:1- A rollout group and a conditional access policy needs to be created
Rollout group to add the users who are subjected to Passwordless Authentication
CA policy needs to be created, and the rollout group needs to be assigned to that policy.
Step:2-Enable Authentication method in Microsoft Authenticator settings.
In Azure Portal>security>Authentication Methods>Policies>Microsoft Authenticator, add the group.
Change the Authentication mode: Passwordless.
Scenario: 1- When the user registering for Passwordless Authentication for the first time.
Step: 1- In your laptop, enter mysignins.microsoft.com>security info>Add Sign-in method>Authenticator app.
Step: 2 -Simultaneously follow the same steps in the mobile to add authenticator.
Step: 3 -Once MFA set up completed, turn that into Default Sign-in Method,
we can see the UID in our mobile phone authenticator app
Step: 4 -In your mobile phone>Authenticator app, click on the UID>Set-up phone sign-in (Sign in without a
password)>Click “Continue”, the device will be registered.
Step: 5 -Once passwordless sign-in method completed for the user ID, we can verify that “Passwordless Sign-in
enabled”.
Step: 6 -When user tries to access any sites, first he will enter the email-ID, then it will automatically prompt the
user to Enter password section, instead of typing password click “Use an app instead”. The number will be
prompted in the device, enter the number and authenticate. This behaviour is only for the first time.
Step: 7-From the second time, once the user enters his email-ID, the number will be prompted out instead of
going for password page.
Scenario: 2- When the user is authenticating through Phone call/SMS-Text message, if the user
needs to change his authentication method to Passwordless Authentication means, please follow
the below steps.
Step: 1- Add the user in the rollout group we have created.
Step: 2- In your laptop, enter mysignins.microsoft.com>security info>Add Sign-in method>Authenticator app
Step: 3- Simultaneously follow the same steps in the mobile to add authenticator
Step: 4- Once MFA set up completed, turn that into Default Sign-in Method.
Step: 5- Now the UID had been registered in our mobile phone.
Step: 6 -In your mobile phone>Authenticator app, click on the UID>Set-up phone sign-in (Sign in without a
password)>Click “Continue”, the device will be registered.
Step: 7 -Once passwordless sign-in method completed for the user ID, we can verify that “Passwordless Sign-in
enabled”.
Step: 8 -When user tries to access any sites, first he will enter the email-ID, then it will automatically prompt the
user to Enter password section, instead of typing password click “Use an app instead”. The number will be
prompted in the device, enter the number and authenticate. This behaviour is only for the first time.
Step: 9-From the second time, once the user enters his email-ID, the number will be prompted out instead of
going for password page.
Scenario: 3- When the user is authenticating through numbering MFA, if the user needs to change
his authentication method to Passwordless Authentication means, follow the below steps.
Step: 1- As the user is using numbering MFA, this must be the users Default Sign-in Method.
Step: 2 - Add the user in the rollout group we have created.
Step: 3 -In your mobile phone>Authenticator app, click on the UID>Set-up phone sign-in (Sign in without a
password)>Click “Continue”, the device will be registered.
Step: 4 -Once passwordless sign-in method completed for the user ID, we can verify that “Passwordless Sign-in
enabled”.
Step: 5 -When user tries to access any sites, first he will enter the email-ID, then it will automatically prompt the
user to Enter password section, instead of typing password click “Use an app instead”. The number will be
prompted in the device, enter the number and authenticate. This behaviour is only for the first time.
Step: 6-From the second time, once the user enters his email-ID, the number will be prompted out instead of
going for password page.
