Share via

Need help setting up passwordless sign in with nfc cards for new users after previous admin left

Ezra Aston 0 Reputation points
2025-11-07T19:38:12.39+00:00

Passwordless sign in was deployed by previous IT admin that quit and left no paperwork or documentation. I am trying to find how he set it up and how to add new employees. I have found a Kerberos server and AAD connect info .... currently half the employees having working cards that log them in. Just don't know how to enter new employees or manage whatever was set up

Windows for business | Windows Server | Directory services | User logon and profiles
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Finn Dang 955 Reputation points Independent Advisor
    2025-11-07T20:21:51.9333333+00:00

    Hi Ezra

    This is almost certainly one of two setups. The fastest way forward is to identify which one you have, then follow the matching path to add new staff.

    First, confirm the stack. On a PC where a card works, run certutil -scinfo. If you see user certificates on the card -> it’s classic smart-card sign-in. If there are no certificates and users originally registered keys at aka.ms/mysecurityinfo -> it’s Microsoft Entra FIDO2 (passwordless).

    If it’s FIDO2 passwordless:

    Open Entra admin center > Protection > Authentication methods > FIDO2 Security Key and make sure it’s enabled and scoped to a group. Create the new user -> add them to that group -> issue a Temporary Access Pass (User > Authentication methods > Add method > TAP) -> user goes to https://aka.ms/mysecurityinfo, chooses Security key, taps the NFC key, sets a PIN, and finishes registration.

    Windows sign-in will show Security key once devices are Azure AD joined or Hybrid joined and the policy “Use security keys for sign-in” is enabled (Intune Account protection or the equivalent GPO). You can manage or revoke keys per user under Entra > Users > Authentication methods. Keep one break-glass admin that does not rely on a security key.

    If it’s smart-card (certificate-based):

    you’ll need access to the Certificate Authority or card-management tool the previous admin used. Create the user with the correct UPN -> enroll a Smart Card Logon certificate for that user -> write it to the NFC card and set a PIN -> test logon on a domain-joined PC. If cloud sign-in with cards is required, enable Entra Certificate-based Authentication and upload the issuing CA chain. If you cannot locate the CA or issuance process, the pragmatic fix is to migrate new hires to FIDO2 keys now while existing users continue on their cards.

    Hybrid clues like a Kerberos server and AAD Connect simply mean you’re in on-prem AD + Entra, that doesn’t block either approach above. If some PCs don’t show the Security key option, verify the join status with dsregcmd /status and push the Windows Hello for Business “Use security keys for sign-in” policy again.

    Pick the path that matches your environment. I hope you find this helpful!
    Regards,
    Finn

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.