Open the Microsoft Endpoint Manager admin center portal and navigate to Devices > Windows > Configuration profiles. To enable the web sign-in credential provider by using the Settings Catalog of Microsoft Intune, follow the eight steps as described below. And it’s also a more IT administrator friendly method, compared to My Security Info, as it doesn’t conflict with Conditional Access when assigning policies to All cloud apps. That would create an option for users to sign-in, without a password, to register their passwordless authentication method. It basically adds a web sign-in option via Azure AD that can be used with passwordless phone sign-in and, more importantly, that can be used with TAP. That credential provider enables support for credentials that are normally not available on Windows. The web sign-in credential provider is supported on Azure AD joined devices and is available with Windows 10 version 1809 and later. Enabling web sign-in as credential provider Also, unlocks/logins with web sign-in do not and will not get single sign-on to on-premises resources. 
Web sign-in is not to be used as your daily driver for login. Note ( as mentioned by Daniel Stefaniak): The combination of web sign-in with TAP is supported only for bootstrap scenarios for other unlock methods. Important: At the moment of writing, the TAP authentication method is still an Azure AD public preview feature.
Experiencing web sign-in in Windows with Temporary Access Pass. Creating a Temporary Access Pass for a user. 
Enabling Temporary Access Pass as authentication method. Enabling web sign-in as credential provider. This post will provide the required configurations and the user experience, by going through the following. That enables users to get quickly up-and-running and enables IT administrators with an alternative method to sign-in to a device when really needed. And all of that without the usage of a password, as TAP satisfies the needed strong authentication requirements. The best thing is that – in combination with the web sign-in credential provider – TAP can even be used with the sign-in to Windows. That sign-in is focused on getting users up-and-running with passwordless authentication and on helping users recover access to their account. 
TAP is a time-limited passcode that basically temporarily enables users to sign-in. The web sign-in credential provider itself is nothing really new, but the ability to use it in combination with TAP is something relatively new. When looking at standard Windows functionality, those alternatives are FIDO2 security keys and the relatively new combination of the web sign-in credential provider with Temporary Access Pass (TAP).
The last few weeks were all about direct Windows Hello for Business functionalities, while this week is all about providing alternatives besides Windows Hello for Business. This week still continues the journey through Windows Hello for Business.
0 kommentar(er)
