Passwordless authentication for enterprise apps and endpoints

The problem with passwords

Passwords have anchored digital security for decades, but they remain one of the most frequently targeted parts of the authentication process. Complex password requirements can contribute to password fatigue, leading users to choose predictable patterns, reuse credentials, or store passwords insecurely.

These behaviors increase exposure to credential stuffing, password spraying, and brute-force attacks across applications. Passwords can also affect the employee experience. A 1Password study found that 44% of employees said logging in and out at work harmed their mood or productivity, while 41% said remembering multiple logins increased stress.

Passwordless authentication addresses these challenges by replacing traditional passwords with stronger methods such as passkeys, security keys, biometrics, and certificates. This reduces reliance on reusable secrets while creating a simpler and more secured sign-in experience.

What is passwordless authentication?

Passwordless authentication verifies users through device-bound credentials, security keys, biometrics, certificates, or other approved methods instead of passwords. With FIDO2 passkeys, the private key stays on the user’s device while the service stores only the public key, eliminating the need to remember, reset, or rotate passwords.

Protection varies by method. Passkeys and security keys resist phishing and credential replay, while email links and one-time codes can still be intercepted or socially engineered.

Identity Access enables organizations to use supported passkeys, biometric-backed credentials, hardware authenticators, certificates, and other passwordless methods across applications, endpoints, and remote access workflows.

Passwordless authentication vs. MFA—what's the difference?

Passwordless authentication and multi-factor authentication (MFA) describe different properties of a sign-in process.

• Passwordless authentication means the user signs in without entering a traditional password.
• MFA means the user proves identity with factors from at least two independent categories.

A passwordless sign-in may use one strong authenticator or multiple factors. An MFA flow may include a password, or it may be completely passwordless.

The two are complementary, not competing. Identity Access lets a phishing-resistant passwordless method be the login and layers adaptive MFA on top when a session's risk warrants extra proof.

How passwordless authentication works in Identity Access

1. The user requests access: The user opens an application, endpoint, VPN, or SSO portal.
2. The user identifies themselves: They enter a username, email address, or select an account.
3. Policy is evaluated: The system determines which passwordless methods and access requirements apply.
4. The user completes passwordless verification: They use a passkey, security key, biometric-backed credential, certificate, or another configured method.
5. The authenticator proves possession: The device or authenticator signs or completes the required challenge.
6. Access is granted: The application or endpoint validates the response and creates the session.

No traditional account password is entered during this flow. Depending on the policy, the user may still complete local verification with a biometric or device PIN.

How FIDO2 passwordless authentication works

FIDO2 provides the foundation for phishing-resistant passwordless authentication. It uses public-key cryptography. A private key remains securely on the user’s device or hardware security key, while the service stores only the corresponding public key. During authentication, the service sends a unique challenge, which the authenticator signs with the private key. The service then verifies the signed response using the stored public key.

The authentication response is bound to the legitimate service origin. A credential registered for one website cannot be used to authenticate to a fraudulent domain. Because the private key is never entered into a webpage or shared with the service, conventional phishing pages cannot capture and replay it in the same way as a password or one-time code.

Supported passwordless methods and authenticators

Identity Access supports a range of authentication methods so organizations can select an appropriate option for each user, application, or access scenario.

FIDO2 passkeys

Passkeys use public-key cryptography and can provide passwordless, phishing-resistant authentication. Users may authenticate with a platform authenticator built into their device or with a roaming security key.

Hardware security keys

FIDO2 security keys, such as YubiKey, require the user to possess the physical authenticator. The user may also need to touch the key or complete local verification before the authentication response is issued. Because they use origin-bound public-key authentication, FIDO2 security keys are phishing-resistant and cannot be replayed on a fraudulent domain. They should not be confused with hardware tokens that only generate one-time codes.

Biometric-backed authentication

Biometrics such as fingerprints or facial recognition can verify the user locally on an enrolled device. In common passwordless implementations, the biometric unlocks a device-bound passkey or cryptographic credential. The remote service receives a signed authentication response rather than the raw biometric image or template.

The biometric itself does not provide the origin binding. The underlying passkey or cryptographic credential provides the phishing-resistant authentication.

Certificate-based authentication

Certificate-based authentication uses a provisioned digital certificate to verify the user or device. Certificates may be stored on a managed endpoint, a smart card, a hardware token, or another protected credential store. This method is suitable for high-assurance and regulated access environments.

Smart cards

Smart cards store a certificate or cryptographic credential and typically require possession of the card along with a PIN or another local verification method.

One-time codes and authenticator applications

TOTP authenticator applications, SMS codes, and email verification codes may support passwordless, fallback, enrollment, or recovery workflows.

Supported options can include:

• Zoho OneAuth
• Google Authenticator
• Microsoft Authenticator
• Software-based TOTP tokens
• Hardware OTP tokens
• SMS verification
• Email verification

One-time codes remove the traditional password from some sign-in flows, but they do not provide the same phishing resistance as FIDO2 credentials. A real-time phishing site may still capture and relay an OTP.

Phishing-resistant, adaptive, and Zero Trust by design

Passwordless done right is phishing-resistant authentication. A FIDO2 credential is a device-bound cryptographic key tied to the origin—an attacker on a spoofed domain has nothing to capture or replay. That closes the door on the phishing and credential-stuffing attacks that target passwords.

Identity Access combines passwordless login with adaptive authentication using risk-based assessments that analyze device, location, and network data to enhance verification only when unusual activity is detected. After sign-in, the session is re-evaluated only when a new authentication event or supported session-control check occurs.

Passwordless authentication and cloud SSO

Passwordless authentication verifies the user without a traditional password. Single sign-on (SSO) allows that authenticated session to be reused across assigned applications. Used together:

1. The user completes a passwordless sign-in to Identity Access.
2. Identity Access establishes an authenticated SSO session.
3. The user opens an assigned application.
4. Identity Access sends the application a trusted SAML assertion or OpenID Connect token.
5. The application validates the response and creates its own session.

The user can then access other assigned applications without entering separate passwords while the SSO session remains valid and applicable access policies continue to be met.

Where you can go passwordless

Identity Access supports passwordless authentication across key enterprise access scenarios.

Enterprise applications

Let users sign in to the identity provider without a password and access assigned cloud and on-premises applications through SSO.

Workstations and servers

Enable access to supported machines using passkeys, biometrics, certificates, security keys, or other device-bound credentials. This can reduce password resets, lockouts, and forgotten password incidents.

VPN and remote access

Protect supported VPN and remote access workflows with passwordless, certificate-based, or security key authentication, combined with contextual access policies.

Privileged access

Require stronger passwordless methods for administrators and high-impact users, including FIDO2 security keys, passkeys, smart cards, and certificates.

Benefits of passwordless authentication using Identity Access

• Reduce password attacks: Public-key methods reduce exposure to phishing, credential stuffing, password spraying, and password reuse.
• Reduce password fatigue: Replace repeated password entry with passkeys, security keys, certificates, or biometrics for a simpler sign-in experience.
• Reduce support requests: Fewer passwords can mean fewer reset, lockout, and forgotten-password issues.
• Strengthen sensitive access: Phishing-resistant methods provide stronger protection for administrators and critical applications.
• Enable secure SSO: Users can access assigned applications without maintaining separate passwords for each one.