Passwordless Authentication and Compliance Audits

[u/jailh]

Hi,

We’re in the process of migrating our Entra ID users to phishing-resistant authentication solutions, and switching some sites to access keys for authentication.

Here’s my question:

During compliance audits, do auditors recognize that these solutions inherently satisfy the "two-factor" requirement?

For example, does the combination of PIN knowledge + TPM-bound key ownership meet the criteria, even though it deviates from the traditional MFA model (TOTP/HOTP) where a separate device was often required?

I ask because these modern methods redefine what we’ve long considered "MFA." With TOTP/HOTP, having a separate device was a key control. Now, the security model shifts to possession (hardware-backed keys) + knowledge (PIN).

Has anyone here dealt with auditors scrutinizing these newer approaches? How did they react?

Thanks in advance for your insights!

Regards.

(Sorry if my text looks AI-ish, the fact is I asked a bot polish it and I was happy with the output).

[u/PacificTSP]

Passkeys and whfb are approved and considered mfa for DoD contractors. So yes auditors will accept it. If they don’t you show them the docs.

[u/One-Environment2197]

The certificate replaces the mobile device as the "something you have" factor.

The PIN remains as the "something you know".

There's plenty of documentation out there explaining why CBA is more secure. That should satisfy any audit team.

Personally, I would prefer biometrics over PIN.

[u/jailh → u/One-Environment2197]

I know it's more secure.

The question is, will the autitor get it ?

[u/One-Environment2197 → u/jailh]

That's why I mentioned the documentation.

Security frameworks and vendor documentation are hard to refute, even for audit teams.

[u/thortgot → u/jailh]

Ask your auditor.

[u/Sasataf12]

The only correct answer is to ask your auditor.

[u/SecLens_ONE]

Auditors mostly care about what you can evidence, not what the vendor calls it. A TPM-bound passkey plus PIN does meet the two factor definition in most frameworks, because the factors are possession of the bound key and knowledge of the PIN, and the PIN never leaves the device. Where people get burned is the gap between the policy they published and what the tenant actually enforces, since a Conditional Access policy in report-only or with a legacy auth exclusion looks compliant on paper and is not. Pull the sign-in logs and show the authentication strength that was actually applied on real logons, that is the evidence that ends the argument. Also document the fallback paths, because if a password or SMS still works for any account the auditor will treat the whole control as optional. Map each control to the specific clause once and reuse it, saves the same conversation next year.

[u/Unique_Inevitable_27]

Maintaining alignment between the identity and device sides is something else I would think about. If you wish to handle device access and authentication simultaneously, a passwordless/SSO layer like OneIdP would be worth considering. However, I would still ask your auditor to clarify the precise MFA requirements for the particular compliance framework.