Question

Contoso wants employees to sign in to cloud apps using the Microsoft Authenticator app without entering a password, approving requests with biometric or PIN verification on their phones. You have enabled the Microsoft Authenticator authentication method policy and targeted all users. Several pilot users report that they can only use Authenticator for MFA push notifications and do not see the option to sign in without a password. What must you configure to enable the passwordless experience?

Accepted Answer

Set the Authentication mode for the Microsoft Authenticator method to 'Passwordless' (or 'Any') for the targeted group, and have users enable phone sign-in from within the Authenticator app.

Answer

Create a Conditional Access policy requiring the 'Phishing-resistant MFA' authentication strength for all cloud apps.

Answer

Enable the FIDO2 security key authentication method and register a passkey for each pilot user.

Answer

Configure a Temporary Access Pass (TAP) policy so users can bootstrap passwordless sign-in.