A municipal help desk wants staff to sign in with a FIDO2 security key instead of typing a shared password. Which authentication approach does that describe?

Passwordless authentication replaces reliance on a typed shared secret with stronger methods such as FIDO2 security keys, Windows Hello for Business, or authenticator-based passwordless flows. When the municipal help desk moves staff to a FIDO2 key instead of a common typed password, each sign-in proves possession of a registered authenticator bound to the user’s identity rather than a secret that can be written on a sticky note or shared across shifts. That approach improves accountability and reduces credential stuffing and password-reuse risk while still authenticating a real Microsoft Entra identity.

Password-only authentication continues to depend on a typed secret for every sign-in and therefore does not match the help desk’s FIDO2 direction. Conditional Access evaluates identity and session signals to allow, block, or challenge access; it is not a packet-port firewall for the city WAN and is not itself the passwordless method. Azure Blob hot tier is a storage performance and pricing tier for frequently accessed objects; it must never be used as a credential store, and public readability of secrets would be a severe misconfiguration.

Exam caveat: passwordless still authenticates users—it removes the password factor, not the identity requirement—so do not confuse it with anonymous or unauthenticated access on AZ-900 questions.

Operational check: register a FIDO2 security key for a pilot help-desk account in Microsoft Entra ID, enforce a passwordless method in authentication methods policy, and validate that the shared password path is blocked or retired for that cohort before broad rollout.