Skip to content

Auth-Onboard#

Passkey & MFA onboarding · v3.3

Auth-Onboard runs passkey and MFA enrolment campaigns for standard (non-privileged) users in Microsoft Entra ID. It finds who still signs in with SMS, a code app or nothing at all, invites them in batches in your own branding, follows up until they've set up Microsoft Authenticator and a passkey, and reports progress to leadership.

It installs into your own Azure subscription from deploy.andykemp.com/mfa, with no scripts to run, and is run from its own admin portal.

Try the live demo Product overview Install

What it sets up#

In Entra ID#

Item What it's for
Passkey-StandardUsers group The onboarding group. People join it when they press Start on their enrol page, or when they're found to have registered already.
Passkey-PhishingResistant group The promoted group. People move here once they've signed in with a portable passkey (Progressive posture).
Passkey profile Passkey-StandardUsers Targeted at both groups, and set to the passkeys you chose at install (see Passkeys). Your tenant must already use passkey profiles: the installer won't make that one-way change for you.
Authentication strength MFA-StandardUsers Passkeys, Windows Hello, certificates, Authenticator and OATH. Not SMS or voice.
Two Conditional Access policies One requires MFA-StandardUsers for the onboarding group, one requires phishing-resistant MFA for the promoted group. Both exclude your break-glass group. See Postures for the state they're created in.
Auth-Onboard-Portal app registration What admins sign in to the portal with. Only people assigned to it get in.

In Azure#

One resource group with:

  • a Static Web App (the admin portal, Standard plan) and its linked Function App (PowerShell, consumption plan);
  • a storage account whose tables hold the people in the campaign, settings and report history;
  • a Key Vault for the mail service key;
  • Application Insights.

The Function App has no public route: it's only reachable through the portal.

Where to go next#