Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Password reuse.
Frequent reset requests.
Credential phishing risk.
Back to solutions
Discuss your use case
What is this solution?
Passwordless authentication replaces typing a secret with another proof, such as a device-bound credential unlocked locally with biometrics or a PIN. In the referenced Windows scenarios, the account can still have managed backend credentials; a passwordless sign-in experience does not mean passwords have disappeared from the architecture.
Passwordless authentication replaces password entry on supported paths. For biometric desktop sign-in and passwordless Windows sign-in, test enrollment and recovery.
Practical example
An employee enrolls an approved sign-in method for their workstation. If they lose the device used for verification, they recover access through a documented process rather than bypassing verification.
Technical summary and scope of use
Technical explanation
The password-free bioaccess technology is a validation mechanism directed to the desktop environments, replacing the introduction of traditional passwords with the biometric authentication using fingerprint or face recognition.
A mobile authentication app ties Windows sign-in to the user's verified identity and the managed credential lifecycle. Users can verify their identity with biometrics without typing a password. IT can manage credential provisioning, rotation and expiration, including automatic password rotation.
The technical goal is to reduce the risks of traditional passwords, provide validation based on biometrics, and automatically manage credentials, while reducing the need for key or hardware codes.
Users sign in to Windows without typing a password. Instead of entering a password or using a hardware security key, they can verify their identity on a phone with a fingerprint or facial recognition.
The solution reduces reliance on passwords and simplifies sign-in. IT teams can automate credential provisioning, rotation and expiration.
It also helps to reduce the complexity of hardware code management, as it relies on a mobile application instead of USB keys or physical authentications, with the possibility of working in unconnected environments.
Scope of use
The technology is used in:
- Access to Windows Desktop Devices
- Reduce Password Dependency
- Management of life cycle credentials
- Control of access via mobile phone
- Supporting environments that can work without connection
What it delivers
Core capabilities that turn the requirement into practical controls.
Authentication and access
Credential management
Deployment environment
Expected value
The impact security teams and leadership can expect from the right implementation.
Faster access
Reduced password theft
Better user experience
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations. Validate phone-to-account binding, revocation after device loss, recovery, and the permitted offline sign-in window. Biometrics alone do not establish MFA or phishing resistance.
Authentication and access
Passwordless sign-in
Replace password entry in the supported sign-in flow; test enrollment and revocation of a lost authenticator.
Fingerprint-based biometric authentication
Use a biometric characteristic on the supported path; review recovery when verification is unavailable.
Biometric authentication using facial recognition
Use a biometric characteristic on the supported path; review recovery when verification is unavailable.
Sign in without typing a password
Define who may perform the action and within which scope; test that unauthorized requests are denied.
Mobile app as the authenticator
The app connects the sign-in request to an enrolled device for verification on supported paths.
Mobile-based access control
Define who can enroll a phone and test how revocation after loss affects subsequent sign-ins.
Software Alternative to validation solutions without a password based on logs or key
Replace password entry in the supported sign-in flow; test enrollment and revocation of a lost authenticator.
Phishing-resistance evaluation
Test the mechanism and recovery paths before comparing it with FIDO2. Removing the password does not establish phishing resistance.
Credential management
Built-in credential lifecycle management
The technology simplifies the user’s access process with the remaining control of the credentials in IT teams.
Credential provisioning
Provision a credential for a known account and define activation and revocation ownership.
Credential rotation
Rotate the secret according to policy and verify that dependent systems can use the replacement.
Credential expiration
Stop accepting expired credentials; test renewal without leaving the old credential active.
Automatic password rotation
Rotate the secret according to policy and verify that dependent systems can use the replacement.
Maintain control over the credential provisioning, rotation and expiration
Provision a credential for a known account and define activation and revocation ownership.
Deployment environment
Windows desktop sign-in
Identify a supported operating or managed platform; verify version, enrollment, and available policies.
Supports enterprise environments
Check how employees and devices enroll and who can revoke sign-in when a role changes.
Supports unconnected environments.
Keep the supported path available without network access; define the grace period and test revocation.
It does not rely on the management of actual code or key equipment.
The app replaces the hardware token in the supported flow; test recovery after phone loss.
Administration and operations
Reduce user complexity during login
Associate users or groups with authorized scope and review how membership changes affect access.
Reduce the load of hardware code management.
Compare representative workflows before and after rollout to measure manual effort and processing time.
Support for expansion at the institution level
Measure behavior under expected load and during a component interruption or recovery.
Separate user experience from the complexity of background credentials management
Credential management stays behind the sign-in flow, so users do not handle the password managed by IT.
How the technology works
Authentication mechanism
The technology solves the traditional password problem by replacing the password input with a biometric authentication using fingerprint or face recognition.
Apply the phone as a motor for authentication.
The technology is based on a mobile application to perform the verification process instead of relying on a hardware code or USB key.
Management of life cycle credentials
Manage credential provisioning, rotation and expiration centrally instead of relying on manual procedures.
Password rotation
The technology uses automatic password rotation, which reduces the need for user intervention in password management.
Support of unconnected environments
The technology supports work in unconnected environments, making the entrance mechanism not always connected to a continuous connection.
What to validate before rollout
- Bind the sign-in method to the employee through a trusted enrollment process.
- Choose a supported method for the device and application, and validate its security properties before rollout.
- Plan for lost or replaced devices and revoke the old sign-in method.
Integration and scope
Test enrollment, recovery, device compatibility, and directory integration. A passwordless user experience does not mean every backend system has stopped using passwords.
Challenges this solution addresses
- Depending on traditional passwords in the login
- The need to enter the password manually.
- Complexity of hardware code or key management
- Cost and operation of physical code management
- Difficulty scaling hardware-based authentication across the organization
- The need to automatically recycle passwords.
- The need to manage the life cycle of credentials
- The need to control the credential provisioning, rotation and expiration
- Need for supporting login in unconnected working environments
- The need to simplify the end user’s access experience
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Identity and access management | Support authentication and access restrictions through passwordless biometric sign-in. Related capability: Identification with fingerprint or face. | Applied |
| Multi-factor authentication and appropriate authentication techniques | Supports a biometric authentication factor within the identity verification mechanisms Related capability: Biological characteristics: fingerprint or face recognition | Applied |
| Periodic review of identity and access rights | Supports the life cycle management of credentials in terms of creation, rotation and expiration Related capability: Management of life cycle credentials | Applied |
| Protection of Information Systems and Processing Facilities | It logs in to the Windows desktop and replaces the traditional password with a biometric authentication mechanism. Related capability: Log in to Windows without a password | Applied |
| mobile device security. | Use a mobile application as a authentication engine. Related capability: Mobile authentication app | Applied |
| Continuity of business | Supports work in unconnected environments. Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Support of unconnected environments | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Identity and access management | The technology supports the restriction of access to desktop environments by replacing traditional password with a biometric authentication mechanism based on user identity Related capability: Log in without a password using fingerprint or face recognition | Applied |
| Multi-factor authentication | Support biometrics as one authentication factor. MFA requires an additional independent factor. Related capability: Biological authentication through fingerprint or face recognition | Applied |
| Control of access to sensitive systems | The technology allows access to the Windows desktop without entering a password Related capability: Access without a password | Applied |
| Credential management | Technology supports life cycle management credentials through creation, rotation and expiration Related capability: Management of life cycle credentials | Applied |
| Management of Passwords | Technology supports automatic password rotation Related capability: Automatic password rotation | Applied |
| Protecting the systems | Technology supports log-in protection to desktop devices using biometric authentication Related capability: Safe login to the Windows desktop | Applied |
| Protection of Sensitive Data | The technology reduces the exposure of authentication data to risk by not requiring the user to enter a password Related capability: Reduce the dependence on passwords | Applied |
| Operational Security | The technology simplifies the user’s access process with the remaining control of the credentials in IT teams Related capability: Mechanism of life cycle management of credentials | Applied |
| Protection of Infrastructure | Technology supports the access point protection to the desktop environment Related capability: Biometric authentication for Windows sign-in | Applied |
| Continuity of access | Technology supports work in unconnected environments Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Support of unconnected environments | Applied |
| Protection of sensitive financial systems | A biometric authentication layer reduces the dependence on traditional passwords when accessing sensitive systems Related capability: Access without a password | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Control of access to OT/ICS | Access control can be linked to validation without a password. Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: Password validation without password. | Applied |
| Identity and access management | Supports the authentication and identity mechanism for users Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: Mobile application for authentication, fingerprint or face | Applied |
| Continuity of OT/ICS | Supports work in unconnected environments Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Support of unconnected environments | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
PAM
Privileged Access Management
Control administrative accounts, sensitive sessions, and approval workflows across critical systems.
Explore solutionCIAM
Customer Identity and Access Management
Govern how customers, partners, and external users access digital services.
Explore solutionMFA
Multi-Factor Authentication
Add a second verification layer for sensitive, remote, and cloud access.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.