Comments on: Onboarding a passwordless Azure AD user https://inthecloud247.com/onboarding-a-passwordless-azure-ad-user/ Intune, Windows, Office 365, Microsoft 365, Azure, Automation Tue, 13 Jan 2026 10:53:00 +0000 hourly 1 By: Artin https://inthecloud247.com/onboarding-a-passwordless-azure-ad-user/#comment-260323 Tue, 13 Jan 2026 10:53:00 +0000 https://inthecloud247.com/?p=11017#comment-260323 I’m wondering if it would make sense to keep TAP in the custom Conditional Access policy you created and make that your default—and only—CA policy.
In other words, you would copy the passwordless authentication strength, add TAP to it, and rely on a single CA policy instead of two (one for onboarding and another for all your resources).

The whole idea is to work around the fact that TAP isn’t included in the passwordless MFA strengths.

What do you think?

]]> By: Andrew https://inthecloud247.com/onboarding-a-passwordless-azure-ad-user/#comment-200637 Tue, 16 May 2023 05:09:35 +0000 https://inthecloud247.com/?p=11017#comment-200637 Great article ?

]]> By: Remco de Kievit https://inthecloud247.com/onboarding-a-passwordless-azure-ad-user/#comment-199732 Fri, 05 May 2023 20:48:13 +0000 https://inthecloud247.com/?p=11017#comment-199732 Hi Peter, great artikel on how you enroll a passwordless account. Did you take a look at the msgraph commands to change the MFA preferred usage ? If you don’t use conditionele access you don’t have to have a p1 license when you only registeerd a security key. I shouldn’t enroll hfb, this is even harder for the user and don’t support roaming users. If a security is already enrolled for the user before the autopilot is starten you never have to use the tap more than 1 time. This means that the user must be enrolled online before the have access to there endpoint device.

]]>