Learn Active Directory - Modern Authentication & Passwordless

#Introduction

In episode 28 we turned AD into a source of compliance evidence. But there's one foundation almost all regulations and security standards now demand: authentication stronger than a mere password. Episode 29 takes you into the modern authentication landscape — from on-premises Active Directory toward Microsoft Entra ID and the passwordless era.

Why must passwords be replaced? Because a password is a secret that can be stolen, guessed, and reused elsewhere. One convincing phishing email can send admin credentials into an attacker's hands without a trace on the network. The focus of modern security isn't making passwords stronger — it's removing the dependence on them.

#Azure AD Becomes Microsoft Entra ID

Azure Active Directory is now called Microsoft Entra ID. It's Microsoft's cloud-based identity service — "Active Directory for the internet era": no Kerberos or LDAP, replaced by OAuth2, OIDC, and SAML.

Two architecture patterns you need to distinguish:

• Cloud-only: identities are born in Entra ID, no on-premises AD. Fits new organizations or those whose applications are all cloud.
• Hybrid: on-premises AD remains the source of truth, synced to Entra ID via Microsoft Entra Connect Sync (episode 20). The most common pattern while legacy applications still live on-premises.

Entra ID isn't a replacement for AD — the two complement each other, and many organizations run in both worlds at once.

#Why Passwords Fail

Passwords face a formidable opponent: phishing, credential stuffing from database breaches, and reuse across many services. MFA closes part of the gap, but even SMS- and one-time-code-based MFA can be beaten by real-time phishing. The solution isn't another patchwork layer — it's authentication that's phishing-resistant by design.

#MFA and Enforcement

MFA is no longer optional. Two mechanisms you must understand:

• Per-user legacy MFA — the old approach, set per account, hard to audit, now being retired by Microsoft.
• Conditional Access — the modern approach: policies evaluated on every sign-in, not per-account settings.

MFA rollout principles:

1. Enable Security defaults for new tenants — MFA required for admins, basic but effective.
2. Require MFA for all admins first, then all users.
3. Block legacy authentication — old protocols (basic auth, IMAP, POP) can't be strengthened with MFA.

#Conditional Access

Conditional Access is Entra ID's policy engine: if the condition is met, apply the control. Its policy structure consists of conditions (users, applications, location, device state) and grant controls (require MFA, compliant device, approved application, or block). The policy skeleton is roughly:

{
  "conditions": {
    "users": { "includeRoles": [ "GlobalAdmin", "ConditionalAccessAdministrator" ] },
    "applications": { "includeApplications": [ "All" ] },
    "clientAppTypes": [ "browser", "mobileAppsAndDesktopClients" ]
  },
  "grantControls": { "operator": "OR", "builtInControls": [ "Mfa" ] },
  "state": "enabled"
}

Conditional Access is one of the main pillars of the Zero Trust architecture: explicit verification on every access, not one-time login trust.

#Windows Hello for Business

Windows Hello for Business (WHfB) replaces passwords on Windows devices. Its principle: not "what you know" (a password), but "what you have" (the device) and "who you are" (biometrics or PIN).

• A PIN is bound to the device and protected by the TPM; it's never sent over the network. Stealing a PIN is useless without the device.
• Biometrics (face, fingerprint, iris) guard the PIN — not a direct password replacement.
• Authentication is based on a key pair, not a replayable shared secret — making it phishing-resistant.

WHfB has two trust models: key trust (simple, key-based) and certificate trust (uses AD CS for logon certificates). For hybrid environments, WHfB leverages Entra Kerberos so users can still access on-premises resources without a password.

#FIDO2 Security Keys and Passkeys

FIDO2 security keys are small hardware devices (like a YubiKey) that perform WebAuthn authentication. Because the private key never leaves the device and is bound to the correct site (origin), FIDO2 keys are phishing-resistant — one of the gold standards of modern authentication.

• Entra ID integration: fully supported as a sign-in method.
• On-premises support: can be routed through WHfB and Entra hybrid.

Passkeys are FIDO2's evolution for convenience: key-based credentials that can be synced across devices (e.g. via phone and browser ecosystems). Users don't need to carry extra hardware while still getting phishing-resistant protection.

#Smart Cards for Special Needs

Smart cards remain relevant for sectors demanding strict compliance (government, military, finance): credentials on the card, backed by PKI (AD CS, episode 18), with revocation policies when the card is removed. This is the "FIDO2 before FIDO2" that's existed in Windows for decades.

#Reducing Legacy Authentication

Don't forget the on-premises side. Legacy protocols are entry points that MFA can't strengthen:

• Basic auth for Exchange Online has been disabled by Microsoft since 2022 — audit applications and clients still using it.
• NTLM (episode 14) is vulnerable to pass-the-hash; audit its usage and restrict it.
• LDAP must have signing and channel binding enabled to prevent relay.

Audit NTLM usage on a DC with Get-WinEvent (requires the NTLM operational log enabled):

Get-WinEvent -FilterHashtable @{ LogName = "Microsoft-Windows-NTLM/Operational" } |
    Measure-Object | Select-Object Count

#Passwordless Roadmap

The passwordless transition isn't an overnight event — it's a staged journey:

Phase 1: Audit legacy authentication and current MFA coverage
Phase 2: Enable mandatory MFA + block basic auth and legacy protocols
Phase 3: Roll out Windows Hello for Business to all devices
Phase 4: Adopt FIDO2 or passkeys for high-risk accounts
Phase 5: Reduce and remove legacy protocols, evaluate full passwordless

Measure success with metrics: the percentage of passwordless logons, the number of legacy auth events, and helpdesk complaints. If legacy auth is declining and passwordless rising, your journey is heading the right way.

#Conclusion

In episode 29 you understood the shift from password-based authentication toward the modern world: cloud-only vs hybrid differences with Microsoft Entra ID, why passwords fail as a security control, MFA enforcement via Conditional Access and Security defaults, Windows Hello for Business with TPM-based PIN and biometrics, FIDO2 and passkeys as the phishing-resistant standard, smart cards for special needs, reducing legacy authentication, and a staged passwordless roadmap with fallbacks.

Key points:

• Passwordless isn't removing all secrets, but removing replayable secrets.
• Conditional Access replaces per-user MFA as the modern enforcement method.
• WHfB and FIDO2 are phishing-resistant key-based authentication.
• Block legacy auth; it can't be strengthened with MFA.
• The roadmap needs fallbacks, metrics, and realistic phases.

This is almost the end of the journey. In episode 30 — the final episode of this series — we'll tie everything together: Production Checklist & Future of AD, from pre-production checks and operational routines, a recap of all 31 episodes, to the future of Active Directory in the modern identity era. See you at the summit!