Microsoft Entra passwordless alternatives
Keep Microsoft Entra ID for your directory, Conditional Access and Microsoft 365, and let MagicEndpoint do the sign-in on managed Windows and Mac computers. WinMagic MagicEndpoint signs people in from the computer itself, with no prompt, works behind Okta and Ping as well, and also covers Windows sign-in, Remote Desktop, SSH, RADIUS and LDAP. Compared below with Beyond Identity, HYPR and Cisco Duo.
Keep Entra ID. Let MagicEndpoint do the sign-in.
Also compared: alternatives to Okta FastPass
At a glance
MagicEndpoint delivers passwordless, phishing-resistant MFA by making the managed computer itself the authenticator, using hardware-backed keys in the TPM or Secure Enclave already built into most laptops and desktops. It can act as a standalone identity provider, or sit behind Microsoft Entra ID, Okta or Ping as a federated or delegated identity provider.
Passkey rollout Air-gapped networksOn-premises, including air-gapped networks with no internet, phones or cloud identity provider; self-hosted; or as SaaS managed by WinMagic and hosted in Microsoft Azure's Canadian datacenter.
Air-gapped networksWeb and SaaS sign-ins through SAML, OIDC and WS-Fed, plus RADIUS, LDAP, SSH and RDP, and Windows sign-in with FIDO2 passkeys, smartcards, the phone app or a TPM PIN.
MagicEndpoint Windows loginMagicEndpoint lists FIPS 140-2 Inside #4190. WinMagic's FIDO Eazy TPM and FIDO Eazy Phone are FIDO2-certified authenticators.
CertificationsWindows Hello for Business is enabled by default on Microsoft Entra joined Windows PCs. Its prompt-free sign-in, the Primary Refresh Token, reaches applications that sign in through Entra ID.
Configure WHfB Primary Refresh TokenRADIUS VPNs through the NPS extension take a call, text, app notification or code, and Remote Desktop works only when the client, the target and the Remote Desktop client all support the method.
NPS extension Remote DesktopWinMagic MagicEndpoint
When your fleet is managed Windows and Mac computers, and you want to keep Entra ID while MagicEndpoint does the sign-in, including for applications behind Okta or Ping, sign-ins beyond the browser and networks with no internet.
MagicEndpoint sits behind Entra ID as a federated identity provider. Entra ID keeps the directory, Conditional Access and Microsoft 365, with no application changes. The same MagicEndpoint also works behind Okta and Ping.
Passkey rolloutPeople sign in to their computer once, and MagicEndpoint signs them in to applications from the computer itself, with no prompt. The key is anchored in the TPM on Windows, where there is one, and in the Secure Enclave on Mac.
On Windows, the same methods work at the sign-in screen and in Remote Desktop and VDI sessions: FIDO2 passkeys, smartcards, the phone app or a TPM PIN.
Windows loginWinMagic lists SAML, OIDC, WS-Fed, RADIUS, LDAP, SSH and RDP among MagicEndpoint's protocols.
MagicEndpointRun it on-premises, including air-gapped networks with no internet, phones or cloud identity provider; self-hosted; or as SaaS managed by WinMagic and hosted in Microsoft Azure's Canadian datacenter.
Air-gapped networksEach sign-in comes from a verified person on a computer that is in policy. If either condition fails, the next sign-in from that computer fails.
MagicEndpoint does the sign-in behind Entra ID on managed Windows and Mac computers, and signs in to the computer itself on Windows. If many of your people work on Linux desktops, compare the other options on this page.
Comparison
Each vendor's column draws only on that vendor's own documentation, linked in the table and listed under Sources.
Scroll sideways to see all five products →
| Criterion | Entra passwordless (Windows Hello for Business) | WinMagic MagicEndpoint | Beyond Identity | HYPR | Cisco Duo |
|---|---|---|---|---|---|
| Credential | |||||
| Where the credential lives | A key on the PC, unlocked with a PIN or biometric; the Primary Refresh Token's session key sits in the TPMPrimary Refresh Token | Anchored in the TPM on Windows, where there is one, and the Secure Enclave on Mac; the phone app for personal and unmanaged devicesPasskey rollout | Device-bound passkeys whose private keys stay in the device's secure hardwareFIDO2 certification | The HYPR phone app as a FIDO2 passkey; also security keys, smart cards and built-in authenticatorsHYPR appAuthenticate intro | Platform passkeys such as Windows Hello and Touch ID, FIDO2 security keys, or Duo Mobile pushPasswordless |
| Extra hardware or phone needed | None on the person's own Windows PC; each device gets its own Windows Hello for Business credentialWHfB FAQ | None on managed Windows and Mac computers; personal and unmanaged devices use the phone appPasskey rollout | None for sign-in; Windows Desktop Login 2.0 needs a YubiKey 5 series keyDesktop Login 2.0 | A phone by default; security keys or smart cards for people without oneAuthenticate intro | None for platform passkeys; push needs Duo Mobile on a phonePasswordless |
| Phishing-resistant options | Microsoft lists Windows Hello for Business, FIDO2 security keys and multifactor certificate-based authentication in its built-in Phishing-resistant MFA strengthAuthentication strengths | Passwordless, phishing-resistant MFA; FIDO Eazy TPM and FIDO Eazy Phone are FIDO2-certified authenticatorsPhishing-resistant MFACertifications | Device-bound passkeys and “only phishing-resistant factors”Zero Trust Auth | Passkey-based MFA, “FIDO Certified from end-to-end”HYPR Authenticate | Passkeys and proximity verification; “Standard Duo Push does not protect against phishing proxy attacks”Methods guide |
| Deployment | |||||
| Deployment model | Part of Entra ID, “a cloud-based user identity and authentication service”Microsoft 365 identity | Behind Entra ID, Okta or Ping as a federated or delegated identity provider, or its own identity provider; on-premises, including air-gapped, self-hosted, or SaaS managed by WinMagic and hosted in Microsoft Azure's Canadian datacenterPasskey rolloutAir-gapped networks | Cloud-native platformSecurity and compliance | HYPR Cloud or self-hostedRelease notes | Cloud service, with an on-premises Authentication Proxy for RADIUS and LDAPAuthentication Proxy |
| Works with no internet | Not through Entra ID, which is a cloud service; for air-gapped networks, Microsoft points to on-premises Windows Hello for Business with a non-Microsoft MFA providerWHfB FAQ | Yes, in an air-gapped deployment: no external connectivity is needed for authentication or policy synchronizationAir-gapped networks | No: devices must reach Beyond Identity's cloud domains, allow-listed in firewalls and proxiesOS support | Workstation Offline Mode, from a limited set of PINsOffline Mode | Windows offline access with Duo Mobile or a U2F security key, for a set number of logins or daysWindows Logon |
| Works with Entra ID | Entra ID's own methodConfigure WHfB | Federated identity provider behind Entra IDPasskey rollout | Entra External Authentication MethodsMicrosoft EAM | Federation, HYPR Enterprise Passkey or External Authentication MethodsEntra ID overview | External MFA method, which needs Entra ID P1 or P2Duo for Entra ID |
| Coverage | |||||
| Computer sign-in and Remote Desktop | Windows sign-in; Remote Desktop only when the client, the target and the Remote Desktop client all support the methodRemote Desktop | FIDO2 passkeys, smartcards, the phone app or a TPM PIN at Windows sign-in, and the same methods in Remote Desktop and VDI sessionsWindows login | Windows Desktop Login; Remote Desktop with its software on the remote machineRemote Desktop | Windows and macOS workstation login; Remote Desktop on WindowsRequirements | Duo for Windows Logon and RDPWindows Logon |
| Protocols beyond web sign-in | Sign-ins through Entra ID; RADIUS VPNs through the NPS extension take a call, text, app notification or code; SSH sign-in covers Azure virtual machines and Azure Arc-enabled Linux serversNPS extensionLinux VM sign-in | SAML, OIDC, WS-Fed, RADIUS, LDAP, SSH and RDPMagicEndpoint | VPN through SAML, for example Fortinet SSL VPNFortinet VPN | Its own RADIUS server for VPN, for example Cisco MerakiHYPR RADIUS | RADIUS and LDAP through the on-premises Authentication ProxyAuthentication Proxy |
| Endpoint operating systems | Windows, on Microsoft Entra joined or hybrid joined PCsConfigure WHfB | Windows and macOS, with Windows sign-in on Windows; the phone app on iOS and AndroidMagicEndpoint | Windows, macOS, iOS and iPadOS, Android and LinuxOS support | Windows, macOS, Linux, iOS and AndroidHYPR Authenticate | Duo Desktop on Windows, macOS and LinuxDuo Desktop |
| Assurance | |||||
| Checks after sign-in | Conditional Access at each token request; continuous access evaluation acts on account events, not device complianceContinuous access evaluation | The key is available only while the verified person is signed in and the computer is in policy; if either fails, the next sign-in from that computer fails | User, device and third-party risk re-evaluated every 10 minutes, including during active sessionsZero Trust Auth | HYPR Adapt: risk policies using device posture and other signalsHYPR Adapt | Duo Desktop health checks such as firewall and disk encryption on Advantage and Premier; security agent checks on PremierDuo Desktop |
| Certifications | Entra ID is authorized at FedRAMP High, in Azure commercial and Azure GovernmentFedRAMP scope | FIPS 140-2 Inside #4190; FIDO Eazy TPM and FIDO Eazy Phone are FIDO2 certifiedCertifications | FIDO2 certified; SOC 2 Type 2Security and compliance | FIDO2, FIDO UAF, FIDO U2F and FIDO Server certified; FIPS 140-2 validated algorithmsCompliance | Duo Federal is FedRAMP Authorized; Duo Mobile meets FIPS 140-3 on supported versionsDuo Federal |
Vendor documentation checked 29 September to 5 October 2026. Vendor pages change, so check the linked page before you decide.
Microsoft Entra passwordless
When every application signs in through Entra ID and you want what is built into Windows, with nothing extra to deploy.
Windows Hello for Business is phishing resistant: Microsoft lists it in its built-in Phishing-resistant MFA strength (Microsoft: authentication strengths). It is “enabled by default for devices that are Microsoft Entra joined” (Microsoft: configure Windows Hello for Business) and “doesn't require a Microsoft Entra ID P1 or P2 subscription” (Microsoft: deploy Windows Hello for Business).
Its prompt-free sign-in reaches applications that sign in through Entra ID (Microsoft: Primary Refresh Token). RADIUS VPNs through the NPS extension take a call, text, app notification or code (Microsoft: NPS extension), and Remote Desktop works only when the client, the target and the Remote Desktop client all support the method (Microsoft: Remote Desktop planning). On managed Windows and Mac computers, MagicEndpoint does the sign-in behind Entra ID; on Windows it also signs people in to the computer and to Remote Desktop sessions. MagicEndpoint covers RADIUS logins under the same policy as the Windows sign-in.
Other alternatives
The full detail for each vendor is in its column of the comparison table.
Beyond Identity is cloud-native: devices must reach its cloud domains, so it doesn't run in air-gapped networks. Its passkeys also cover Linux desktops, and it re-checks user, device and third-party risk every 10 minutes during a session. Its Windows Desktop Login 2.0 needs a YubiKey 5 series key and doesn't support Entra ID-only devices.
OS support Zero Trust Auth Desktop Login 2.0HYPR makes the phone the main authenticator, with security keys or smart cards for people without one. It runs as HYPR Cloud or self-hosted and also covers Linux endpoints. Offline, workstations unlock from a limited set of PINs.
Authenticate intro Release notes HYPR Authenticate Offline ModeDuo connects to Entra ID as an External MFA method, which needs Entra ID P1 or P2. RADIUS and LDAP go through its on-premises Authentication Proxy, and Duo Federal is FedRAMP Authorized. Duo says “Standard Duo Push does not protect against phishing proxy attacks”, so phishing resistance needs passkeys or proximity verification.
Duo for Entra ID Authentication Proxy Duo Federal Methods guideDesign
Because Zero Trust has to check both at once: an authorized person on a compromised device should not get in.
NIST's Zero Trust architecture decides access by “dynamic policy—including the observable state of client identity, application/service, and the requesting asset” (NIST SP 800-207).
MagicEndpoint holds the person, the device and its policy state in one key on the computer. The key is available only while the verified person is signed in and the computer is in policy. When either fails, the key is made unavailable, so the next sign-in from that computer fails while the person's other devices keep working.
Deployment
Entra ID hands the sign-in to MagicEndpoint as a federated identity provider, the computer answers with no prompt, and Entra ID issues its tokens as it does today.
enforceMfaByFederatedIdp, Entra ID counts a federated sign-in as “federated multifactor”, which its built-in Phishing-resistant MFA strength does not include (Microsoft: how authentication strength works). Agree how your deployment meets each policy's requirements.MagicEndpoint deploys behind the identity provider you already run, with no application changes. Talk to WinMagic about which sign-in paths your deployment covers.
FAQ
WinMagic MagicEndpoint, Beyond Identity, HYPR and Cisco Duo. MagicEndpoint keeps Entra ID and does the sign-in on managed Windows and Mac computers, works behind Okta and Ping as well, and also covers Windows sign-in, Remote Desktop, SSH, RADIUS, LDAP and air-gapped networks. Beyond Identity is cloud-only and also covers Linux desktops. HYPR makes the phone the main authenticator. Duo is a cloud service with an on-premises proxy for RADIUS and LDAP, and needs passkeys or proximity verification for phishing resistance.
Windows Hello for Business signs people in to Windows PCs and to applications that sign in through Entra ID. MagicEndpoint sits behind Entra ID as a federated identity provider and signs people in from the managed Windows or Mac computer itself, with no prompt. It also covers RADIUS, LDAP, SSH and Remote Desktop, and works behind Okta and Ping as well as Entra ID.
No. Entra ID keeps the directory, Conditional Access and Microsoft 365. MagicEndpoint does the sign-in behind it on managed Windows and Mac computers, with no application changes. It can also act as its own identity provider.
Where every application signs in through Entra ID and you want what is built into Windows. Windows Hello for Business is enabled by default on Microsoft Entra joined devices and doesn't require an Entra ID P1 or P2 subscription.
Yes. Microsoft lists it in the built-in Phishing-resistant MFA strength, with FIDO2 security keys and multifactor certificate-based authentication. It covers sign-ins that run through Entra ID.
When the domain federation is set to enforceMfaByFederatedIdp, Entra ID counts a federated sign-in as “federated multifactor”, which its built-in Phishing-resistant MFA strength does not include. If your Conditional Access requires that strength, agree with WinMagic how your deployment meets it before rollout.
Yes. In an air-gapped deployment, MagicEndpoint runs entirely on-premises, without internet connectivity, phones or a cloud identity provider. It is also available self-hosted, or as SaaS, managed by WinMagic and hosted in Microsoft Azure's Canadian datacenter.
Managed Windows or Mac computers, and MagicEndpoint set up as a federated identity provider in Entra ID. No application changes. People on personal or unmanaged devices can use the MagicEndpoint phone app.
Every statement about another vendor comes from that vendor's own documentation, checked 29 September to 5 October 2026. What phishing resistance means is on our phishing-resistant MFA page.