Skip to content

Before you start#

Agree these first#

Agree these with whoever owns identity in the organisation:

  1. Synced passkeys can't be attested. Entra can't vouch for them, and the person's Apple, Google or password-manager account becomes part of your security. That's the right trade for most standard users, and it's why privileged accounts are kept out. If it isn't right for you, choose device-bound passkeys with attestation: see Passkeys.
  2. The most permissive passkey profile wins. Privileged accounts must never be in either group. Auth-Onboard blocks them, but don't add anyone to these groups by hand.
  3. Turning synced passkeys off later breaks the ones people have.
  4. Protect first-time registration. Anyone with a person's password could register first. Consider a Conditional Access policy on Register security information (a trusted network, or a Temporary Access Pass). The installer tells you whether you have one.
  5. Choose a mail service. Recipient addresses and the emails, including their links, pass through it. See Mail services.

What you need#

  • An Andy Kemp Consulting account with access to Auth-Onboard.
  • Entra ID P1. With P2, the privileged-account check also covers eligible PIM roles.
  • An Azure subscription, and the roles in Roles: least privilege. Global Administrator isn't needed.
  • Passkey profiles enabled in the tenant (Entra admin center > Authentication methods > Passkey (FIDO2)). It's a one-way change, so the installer leaves it to you.
  • A break-glass group, role-assignable. Optionally a group of privileged accounts (also role-assignable) and a group of portal admins.
  • An account with a mail service, with your sending domain verified and a send-only API key.