We're migrating Entra ID users to phishing-resistant authentication and moving some sites toward passkeys or other access-key methods. For compliance purposes, will auditors recognize a TPM-bound key combined with a local PIN as satisfying a two-factor or MFA requirement? The model is possession of the hardware-backed key plus knowledge of the PIN, rather than the traditional password-and-TOTP setup that uses a separate device. Has anyone had auditors review passkeys, Windows Hello for Business, or certificate-based authentication, and what evidence did they require?
4 Answers
The TPM-backed credential serves as the possession factor, while the PIN is the knowledge factor. The PIN unlocks the credential locally and isn’t transmitted to the identity provider. Biometrics can also be used instead of the PIN where supported, but the important part is documenting how the factors work and mapping them to the applicable control.
Auditors usually care more about evidence than the product label. Show that the authentication-strength policy is actually enforced, provide sign-in records demonstrating the required method was used, and document exceptions and fallback paths. Check for report-only policies, legacy-auth exclusions, password recovery routes, or SMS fallback, since those can make the control weaker than it appears on paper.
The safest answer is to confirm the interpretation with the auditor before the audit. Requirements vary by framework, and some auditors may want an explicit statement showing that the selected authentication method meets the organization’s policy.
Passkeys and Windows Hello for Business are generally recognized as phishing-resistant MFA, including in many regulated environments. If an auditor questions it, provide the relevant framework guidance and your authentication architecture documentation.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures