The requirement specifies that:
* Users must sign in using Microsoft Entra credentials,
* Multi-factor authentication must be out-of-band,
* Password sign-ins must be prevented.
According to Microsoft Learn: "Configure passwordless authentication in Microsoft Entra ID" and the SC-
300 Exam Ref , the two supported passwordless and MFA-capable authentication methods that satisfy these conditions are:
* Microsoft Authenticator app - Supports passwordless sign-in using push notifications, providing both identity verification and multi-factor authentication in a single step.
* FIDO2 Passkey - Enables secure passwordless authentication through hardware security keys or device-bound passkeys that rely on public key cryptography and satisfy MFA requirements when configured properly.
Both methods eliminate password usage entirely and integrate with Microsoft Entra for strong identity assurance.
Windows Hello for Business is passwordless but limited to Windows devices (VM1 is Linux). Temporary Access Pass (TAP) is a bootstrap mechanism for enrolling in passwordless sign-in, not a long-term solution.
SMS authentication, while MFA-capable, still requires passwords for primary authentication and doesn't meet the passwordless requirement.