How to join Windows 10/11 Pro computer to Azure AD with passwordless authentication?

Question

We implemented passwordless authentication in our Azure AD environment and use Windows 10 and 11 Pro in our computers. When joining a computer to Azure Active Directory for the first time, the only option presented to a user is to provide their Azure AD username and password. Since we reset all of the passwords to something nobody knows, it seems Microsoft requires a password to join Windows 10/11 computers to Azure AD.

Then even AFTER joining, the user still needs their password the first time they login. Subsequently, any new users who attempt to login to the computer using their Azure AD credentials ALSO need their password, because it only asks them to setup Windows Hello for Business AFTER they login the first time.

The work-around I use right now is to reset their password, have them login, change it, then setup Windows Hello for Business. Not a good solution as this requires intervention and a lot of steps.

So, how can we completely eliminate passwords in this scenario?

Answer 1

First, note that this really has nothing to do with Intune but is AAD specific.

Today, there is no direct passwordless path for initial Windows AADJ, however, Temporary Access Password (https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-temporary-access-pass) is planned to be enabled during Windows OOBE in the near future.