Sander Berkouwer discusses moving away from passwords towards passwordless authentication. He argues that passwords are problematic because they can be cracked, intercepted, stolen or breached. 81% of digital incidents in 2018 involved weak or leaked credentials. 20% of IT costs go towards facilitating password resets. Windows Hello for Business provides a passwordless authentication option using a PIN, fingerprint or authentication app on Windows 10 devices. It supports single sign-on and multi-factor authentication. FIDO 2.0 security keys provide a unique key per application that cannot be reused. Berkouwer outlines Microsoft's journey towards passwordless authentication and the changes needed to processes like Azure AD join that currently rely on initial passwords.

2. #O365Connect @SanderBerkouwer
A life without
passwords; dream
or reality?
Sander Berkouwer
Chief Technology Officer
SCCT scct.nl

3. Introduction
Sander Berkouwer
I live in the Netherlands
I work at SCCT scct.nl
@SanderBerkouwer
#O365Connect
I have a passion for Active Directory
and Azure Active Directory.
I’m a Microsoft MVP, Veeam Vanguard
and VMware vExpert
I wrote the AD Administration Cookbook

4. Why passwords are bad

5. Why passwords are bad
Passwords are problematic
They can be:
• Cracked
• Intercepted, shoulder-surfed and phished
• Stolen, breached and re-used
Passwords are in the way
People aren’t designed to remember passwords
Password resets cost organizations lots of productivity
and thus money

6. How bad?
81% of all digital
incidenten in 2018 were
caused by weak, leaked and
standard credentials.
20% of IT costs spent by
organizations is to facilitate
password resets.

7. “Do away with passwords
for day-to-day use”
Password-less

8. What we need (~98%)
Credentials that can’t be reused
Multi-factor Authentication is today’s go to solution
Most organizations use One-time Passwords (OTPs) in text
messages
Authentication methods that are easier to use
Multi-factor Authentication is not easy to use for a lot of
people
Non-crackable, non-interceptable credentials
We need a new way to authenticate
• With local storage of (biometric) credentials
• With Quantum-proof encryption

9. What’s available today, technically
Locations and physical security
On- and offboarding procedures
802.1x network security
Devices
Removing local admin rights
Windows Hello for Business
Applications and systems
Azure MFA and Azure MFA Server
Azure AD Conditional Access
Data
OneDrive Personal Vault
Locations
Devices
Applications
and systems
Data

10. How we’re deploying all this technology
G-SuiteAzure AD
Connect
Azure AD
Active Directory
Domain Services
IT personel
Colleagues
Office 365
On-premises
applications
Remote
access
Work from home
Multi-factor
authentication
required
Multi-factor
authentication
required
Colleagues

11. Windows Hello for Business

12. Windows Hello for Business
Look ma, no passwords!
Password-less, strong authentication
Available on Windows 10
Multi-factor Authentication, by default
PIN, fingerprint, AuthN App are 1st factor
Enrollment, linked to TPM, is 2nd factor
Single Sign-On

13. Authentication Methods
Authenticator Biometrics
Security Key
(FIDO 2.0)
Convenience
PIN
123456

14. Deployment Scenarios
Azure Active Directory cloud-only
Upon Azure AD Join, you enroll into Windows Hello for Business
Device registration is performed with Azure AD as Identity Provider
Hybrid
Device registration is performed with Azure AD as Identity Provider
Requires Azure AD Connect, synchronizing all colleagues in scope
Active Directory (on-prem only)
Device registration is performed with Active Directory Federation
Services
Requires AD FS 2016 FBL and 3rd Party AD FS MFA Adapter
Requires Windows Server 2016-based Domain Controllers for key trust
Requires a Certificate Registration Authority for certificate trust

15. Trust Options
Key Trust
Uses the raw key for
authentication
Requires at least one Windows
Server 2016 –based Domain
Controller, and thus:
Windows Server 2016 AD Schema
Windows Server 2016-version Domain
Controller certificates
Certificate Trust
Uses a client-side enrolled
certificate for authentication
No Windows Server 2016 Domain
Controllers required, but:
Windows Server 2016 AD Schema
AD FS on Windows Server 2016
Windows Server 2016 AD FS FBL
Device Registration in AD FS
Certificate for each user/client
3rd Party AD FS MFA Provider

16. Authentication Methods
Authenticator Biometrics
Security Key
(FIDO 2.0)
Convenience
PIN
123456

17. Windows 10
device
Azure
Active Directory
1 2 3 4
How is a FIDO authentication different?
Kerberos
authentication
FIDO 2.0
authentication
Domain-joined
Windows device
Active Directory
Domain services
1 2 3 4
1. KRB_AS_REQ
2. KRB_AS_REP
3. KRB_TGS_REQ
4. KRB_TGS_REP
5. KRB_AP_REQ
6. KRB_AP_REP
5
6
7
1. Hello
2. Nonce
3. (Nonce)WHfB Key
4. PRT, ID, ST
5. PRT
6. AccessToken
+RefreshToken
7. AccessToken
5 6
Windows 10
device
Azure
Active Directory
1 2 3 4
3
Or: Federation
TPM
3
TPM
3
4
1
2
4
4
1. Request
2. Challenge
3. (Challenge)Private Key
per application
4. (Challenge)Public Key
PRT, ID, AccessToken,
etc.
Windows Hello
authentication

18. FIDO 2.0 gaining traction
The Dutch Cybersecurity Center (NCSC)
advises FIDO 2.0
- Koen Sandbrink, Advisor at NCSC, during his talk
"We Are Going to Kill Passwords (or at Least
Try)“ during the One Conference, October 2019
Source

19. In the grand scheme of
things…

20. Microsoft’s Password-less journey

21. What if…
Everybody uses password-less authentication?
We’ll be moving from password resets to PIN resets
Passwords expire, but people no longer use them regularly
Expect an increase in password resets, until…
Everybody has their passwords cleared
How do we do Azure AD Join without a password?
How do we provision people without an initial password?
… loads of processes will need to be redesigned

22. Concluding

23. Windows Hello for Business
Authentication method that is safer and more secure
Authenticate using a PIN, your finger or your face
Authentication with Windows Hello is multi-factor
authentication
Non-crackable, non-interceptable credentials
Storage of (biometric) information is local
When using federation: token-based Single Sign-on
Credentials that can’t be reused
When you use FIDO 2.0 keys you get a secure key per service

24. Thank you!