A municipal call center evaluates passwordless sign-in for library public-desk shared devices used by rotating clerks. What should the team weigh carefully?

Passwordless sign-in can reduce password reuse and improve usability for municipal library clerks, but shared public-desk devices change the risk picture. Rotating staff on kiosk-like desks need careful identity binding, session lifetime, sign-out hygiene, and least privilege so the next clerk does not inherit the previous session's Microsoft 365 context. Weighing passwordless benefits together with shared-device and session design is the sound fundamentals evaluation—not convenience alone.

Claiming FIDO2 keys bound to the shared profile can provide sign-in for each clerk fails because the credential still authenticates the shared profile rather than the individual clerk, so careful PIN handling alone does not create per-clerk identity binding or prevent session inheritance. Claiming Microsoft Authenticator on a shared tablet can give each clerk sign-in fails because an authenticator left on shared hardware does not prove which clerk is present, so careful account separation alone still lets the next person inherit the previous clerk's authenticated Microsoft 365 context without proving who they are. Claiming Conditional Access verifying key possession can isolate user sessions fails because Conditional Access only evaluates sign-in conditions and does not itself separate sessions or enforce sign-out hygiene, so careful policy design alone does not separate rotating clerks on shared hardware.

Exam caveat: AB-900 covers purpose and tradeoffs at describe depth, not implementing Windows Hello for Business or kiosk lockdown baselines end to end. Shared-device patterns may include separate accounts, quick sign-out, or dedicated kiosk modes—details vary by exam scope, but the principle is identity-plus-session design on shared hardware.

Operational check: Pilot passwordless for staff accounts on a representative library public desk, enforce short sessions or mandatory sign-out between clerks, block local caching of privileged credentials, and confirm Conditional Access still evaluates device and user conditions. Validate that a clerk leaving the desk cannot leave an open authenticated session for the next visitor or coworker.