01
Why Passwords Keep Failing Businesses
Compromised credentials are involved in over 80% of confirmed data breaches. The reasons are consistent: passwords are too short, reused across services, or captured via phishing. And the solution most businesses deploy — password complexity policies — makes things worse, not better.
When users are required to use complex passwords they can't remember, they write them down, use predictable patterns (Password1!, Summer2026), or reuse the same complex password everywhere. Complexity requirements without good credential management create the illusion of security without the reality.
The NIST Digital Identity Guidelines (SP 800-63B) no longer recommend mandatory password complexity or expiry. They recommend length, breach checking, and MFA. The 'must contain uppercase, number, and symbol' era is over.
03
MFA: The Most Important Password Control
Multi-factor authentication makes a compromised password ineffective on its own. Even if an attacker has your password, they cannot log in without the second factor.
MFA methods ranked by security
| Method | Phishing Resistant | Recommended |
|---|
| Hardware security key (FIDO2) | Yes | Best — recommended for admins and high-value accounts |
| Passkey (device-bound) | Yes | Excellent — supported by Windows Hello, Face ID |
| Microsoft Authenticator (number matching) | Partial | Good — current standard for most users |
| TOTP authenticator app (Google Authenticator) | No | Acceptable — better than SMS |
| SMS OTP | No | Avoid — SIM swap risk; only if no other option |
MFA fatigue attacks — flooding users with MFA prompts until they approve one — are now common. Microsoft Authenticator with number matching and additional context is the recommended defence.
04
Passkeys: The Future of Authentication
Passkeys are cryptographic credentials that replace passwords entirely. They're stored on the user's device and authenticated using biometrics (fingerprint, Face ID) or device PIN. They cannot be phished, stolen remotely, or reused.
How passkeys work
✓A public/private key pair is created for each service — the private key never leaves the device
✓Authentication is proved by device biometric or PIN — no password is transmitted
✓Even if the authentication server is breached, no usable credentials are exposed
✓Works across all major platforms — Windows Hello, Apple FaceID/TouchID, Android biometrics
Enabling passkeys for Microsoft 365
✓Microsoft Authenticator passkey support — enabled in Entra ID authentication methods policy
✓Windows Hello for Business — passkey-compatible authentication for domain-joined and Azure AD joined devices
✓FIDO2 security keys — hardware passkeys for users without compatible devices
05
Enterprise Password Management
For accounts that still require passwords (on-premise systems, SaaS apps without SSO, vendor portals), an enterprise password manager provides secure generation, storage, and sharing.
✓Every account gets a unique, randomly generated password — 20+ characters
✓Passwords are stored encrypted in the vault — accessible only to authorised users
✓Shared accounts (e.g. social media, vendor portals) managed via shared folders with access control
✓Password rotation triggered on staff departure — immediate, not manual
✓Audit log of all password access and changes
Recommended platforms
✓1Password Business — widely used, strong audit capabilities, Entra ID SSO integration
✓Bitwarden for Business — open source, auditable, cost-effective
✓Azure Key Vault — for service accounts and application secrets (not for end users)
✓Microsoft Entra ID Password Manager integration — works with many enterprise password managers
06
De4sec Identity and Password Security Service
MFA Deployment
Enforce MFA via Conditional Access for all users. Configure Microsoft Authenticator with number matching. Disable legacy authentication.
Passkey Enablement
Configure Windows Hello for Business, Authenticator passkeys, and FIDO2 security key support for high-value accounts.
Password Manager
Deploy and configure enterprise password manager. Migrate credentials, set policies, train staff.
Identity Protection
Entra ID Identity Protection configuration — risk policies blocking high-risk sign-ins automatically. Breach credential monitoring.
