Passkey & MFA onboarding · Runs in your Azure
Move everyone to passkeys, one batch at a time
Auth-Onboard runs the campaign for you: it finds who still signs in with SMS or codes, invites them in your branding, follows up until they've set up a passkey, and shows leadership how far you've come.
For your admins
A campaign in five steps
The portal's Overview always shows where you are and the one thing to do next.
- 1
Make it yours
Your company name, colours, logo and wording in every email and page. Send yourself a test.
- 2
Find people
Scan the tenant and see everyone by how they sign in today: SMS, code apps, nothing at all, Authenticator, passkeys.
- 3
Send a batch
Import a group into batches, then send when you're ready, or on a schedule: one batch every few days.
- 4
Let it follow up
Reminders, a manager escalation and the next step's email go out by themselves. You deal with the few who are stuck.
- 5
Lock it down
People who've signed in with a passkey move to the phishing-resistant group and policy, and stay protected.
For your people
What the person being moved sees
One step at a time, each prompted by its own email, and every email and page in your branding, not ours.
Postures
Choose how far, how fast
The posture decides where people are steered and which Conditional Access strength applies. You choose it when you install and can change it later.
Progressive
RecommendedAuthenticator first, then a passkey. People move to phishing-resistant sign-in only after they've used their passkey.
Passkey first
Straight to a passkey, with Authenticator as the fallback.
MFA only
Everyone onto Microsoft Authenticator. A good first step for tenants still on SMS.
Passkey only
Passkeys and nothing else, with the phishing-resistant strength from the start. Needs a Temporary Access Pass process.
Security
Built so it can't make things worse
Admins are never enrolled
Privileged accounts, including eligible PIM roles, group-based roles and your break-glass group, are blocked at import, checked again before every group add, and removed on every hourly run.
Links only work for one person
Each email carries a new random token. Only its hash is stored, it expires, and opening the link does nothing until the person presses Start.
It can't change anyone's sign-in
No permission to add, remove or reset authentication methods, and no Temporary Access Passes. People do that themselves, or your service desk does.
Runs in your Azure
A Static Web App and Function App in your subscription, with its data in your own storage account. Andy Kemp Consulting holds no tokens, keys or user data.
Least privilege for mail
A send-only API key in your Key Vault, to an endpoint fixed in the code. No Mail.Send in Entra. Link tracking is turned off where the service allows.
Your existing policies stay as they are
It adds its own Conditional Access policies and never changes yours. Tenant-wide changes are shown before and after, and wait for you to type a confirmation.
Install
Installs from your browser, no scripts
Sign in at deploy.andykemp.com/mfa, pick a subscription, your break-glass group and a mail service, and review every change before it's made. Updates come the same way, with your settings and data kept.
- An Azure subscription: Contributor, plus Role Based Access Control Administrator limited to three roles
- No Global Administrator: five Entra admin roles, activated just for the install
- Entra ID P1
- A break-glass group, and an account with a mail service
Questions
Frequently asked
How do we get access?
Installing needs an Andy Kemp Consulting account with access to Auth-Onboard: talk to Andy. It then runs on Azure resources in your own subscription (a Static Web App on the Standard plan, a consumption Function App, storage and Key Vault), billed to you by Microsoft, and your mail service sends the emails.
What licences do we need?
Entra ID P1, for Conditional Access and group-based assignment. With Entra ID P2 it also checks eligible PIM roles when it looks for privileged accounts.
Who sends the emails?
Your mail service: SMTP2GO is the default, and SendGrid, Mailgun, Postmark, Brevo, Mailjet, Resend, any SMTP service with an API key, or your own relay all work. Emails come from your address, in your branding.
What about people without a smartphone?
Mark them as an exception with a reason and a review date. They get no reminders or escalation, and they're still checked, so if they register a security key they're counted as done.
Someone in the phishing-resistant group has lost every device. What now?
Your service desk removes them from the Passkey-PhishingResistant group, checks who they are and issues a Temporary Access Pass in Entra. They're back in the onboarding journey and add a new passkey.
Do we have to allow synced passkeys?
No: you choose at install. Synced or device-bound (the default) is easiest for people and survives a lost phone, but Entra can't attest synced passkeys. Device-bound only, with attestation, accepts just Microsoft Authenticator and security keys: stronger assurance, more Temporary Access Pass requests when phones are lost. Either way, privileged accounts are kept out.
Click around before you install
The demo is the real admin portal with a made-up company in it. Scan, import, send and read the report: nothing is sent and nothing connects to Microsoft.