Develop a Credential Strategy (Including Passwordless Authentication)

Passwords remain one of the weakest links in identity security, driving the majority of account compromise and phishing incidents. A credential strategy defines how your organization issues, protects, and eventually replaces passwords with stronger, phishing-resistant authentication methods such as FIDO2 security keys, Windows Hello for Business, or certificate-based authentication.

Steps to implement

• Inventory current authentication methods across all identity systems (AD, Entra ID, VPN, SaaS apps) and identify where passwords are the sole factor.
• Enforce MFA everywhere possible as an immediate baseline, prioritizing phishing-resistant methods (FIDO2, certificate-based) over SMS or OTP.
• Pilot passwordless authentication (Windows Hello for Business, FIDO2 security keys, or Microsoft Authenticator passkeys) with a small user group, starting with privileged accounts.
• Define a rollout plan and timeline to expand passwordless coverage to broader user populations, retiring legacy password-only flows where feasible.
• Update password policies (length, rotation, banned-password lists) for accounts that must remain password-based during the transition.
• Document the strategy, including exceptions, fallback methods, and a review cadence to track adoption metrics.