The endpoint is the entry point
A compromised Windows login opens the door to ransomware and lateral movement. Hardening it removes the attacker’s easiest first step.
MagicEndpoint · Windows Login
Strong MFA at the Windows login screen
MagicEndpoint gives every user a phishing-resistant way into Windows — FIDO2 passkeys, certificate-based smartcards, the MagicEndpoint phone app, TPM PIN and more. The same methods extend to pre-boot, RDP and VDI, and manager approval covers the exceptions.
Eleven login methods, one client — assignable per user
- Eleven login methods, one client — assignable per user
- FIDO2, certificate and password backends
- Offline-capable over Bluetooth Low Energy
- Same methods at pre-boot, with SSO to the desktop
Why it matters
Password-only Windows login no longer holds
Attacks on the endpoint are persistent, and the Windows login is where they start. Securing it is now a baseline expectation — from insurers, auditors and zero-trust programs alike.
Cyber insurance expects endpoint MFA
Most cyber-insurance policies now require multi-factor authentication for logging into the endpoint itself — not only for cloud applications.
IAM portals stop at the browser
IAM single sign-on secures remote applications but leaves the endpoint unprotected. Adding a separate MFA product for the login screen fragments the security stack.
...discontinue support for authentication methods that fail to resist phishing...”
Authentication methods
Choose how your users sign in
Offline plant floors, PKI mandates, frontline devices, remote staff — no single factor fits every situation. MagicEndpoint offers the broadest choice of Windows login methods on one client, assignable per user with recovery options for each.
Passkey (FIDO2)
Passwordless
Phishing-resistant
Offline-capable
The modern standard for passwordless login, and rapidly becoming the preferred method across enterprises. The phone signs a per-login cryptographic challenge with a hardware-backed key — there is nothing reusable for an attacker to intercept.
BLE Phone
Passwordless
Phishing-resistant
Offline-capable
Proximity-based login over Bluetooth Low Energy. The prompt only reaches a phone that is physically near the endpoint, creating a strong association between user and machine — and it works with no network at all.
Network Phone
Passwordless
Phishing-resistant
Remote-friendly
The same phone experience for environments where Bluetooth is not an option. The challenge is routed to the MagicEndpoint app over a secure TLS connection, so home-office and remote users authenticate consistently.
CBA Phone
Passwordless
Phishing-resistant
Certificate-based
The phone acts as a virtual smartcard, performing certificate-based authentication with X.509 certificates over Bluetooth — no physical token to issue. Supported today; new deployments are steered toward FIDO2 passkeys.
Smartcard / Hardware token
Phishing-resistant
Offline-capable
PIV-compliant
For organizations mandated to use PIV smartcards or USB tokens such as YubiKey. Certificate-backed, high-assurance identity verification, trusted in enterprise and government settings.
TPM PIN
Passwordless
Phishing-resistant
No extra hardware
A PIN verified against the endpoint’s own TPM chip. The PIN never leaves the device, so it cannot be phished or attacked remotely — a strong option when external tokens are hard to manage.
Biometric
Passwordless
Phishing-resistant
Windows Hello
A quick face or fingerprint scan on the endpoint’s built-in reader — no password involved. Hardware-backed and device-bound, it resists spoofing and replay while keeping login nearly instant.
Password + Biometric
Two-factor
Hardware-backed
Something you know plus who you are: the user enters their password, then scans a face or fingerprint through Windows Hello. A strong, familiar step up for teams not yet ready to drop passwords.
Password + Push (MFA)
Two-factor
Familiar
The user enters their password, then approves a push notification in the MagicEndpoint app. The second factor confirms user presence and adds possession to knowledge — a simple first move away from password-only login.
Manager Approval
Human fallback
Recovery
When the usual method is unavailable — a lost phone, a forgotten token — a designated manager verifies the request from their own MagicEndpoint app and approves or denies it with their biometrics.
Password
Universally supported
The traditional typed Windows password — familiar, universally supported and still the most common way into Windows. The methods above add stronger, phishing-resistant factors; pairing it with push or biometrics is an easy first step up.
Fallbacks are configurable per method — self-help recovery, one-time passwords, alternate password (BLE) and manager approval — so a lost factor never becomes a lost workday.
Side by side
Every method at a glance
What the user does, how strong it is, and what runs underneath — on one screen for easy evaluation.
| Login method | User sees / does | Security strength | Backend notes |
|---|---|---|---|
| Passkey (phone app) | Login → phone signs the challenge (Bluetooth) | Very high | FIDO2-based; the modern standard method |
| CBA Phone (phone app) | Login → phone emulates a smartcard (Bluetooth) | Very high | Certificate-based (X.509); established method |
| BLE Phone (phone app) | Login triggers a phone prompt (Bluetooth) | High | Password backend; proximity-based, offline-capable |
| Network Phone (phone app) | Login triggers a phone prompt (network) | High | Password backend; remote-friendly over TLS |
| Smartcard / Token | Insert card or token → enter PIN | High | Certificate-based (PIV); high assurance |
| Password + Biometric | Enter password → scan face / fingerprint | High | Strong MFA; uses Windows Hello |
| TPM PIN | Enter PIN | Medium–high | PIN never leaves the device |
| Password + Push (MFA) | Enter password → approve push on phone | Medium | Adds a possession factor to the password |
| Biometric | Scan face / fingerprint | Medium | Passwordless; fast, device-bound |
| Manager Approval | Login triggers the manager’s phone for approval | Medium | Manual approval; recovery and exception cases |
| Password | Enter password | Low | Native Windows credential; strongest with a second factor |
Phone-app methods use the MagicEndpoint app for iOS and Android. Availability by access layer (pre-boot / Windows login / online) is detailed in the MagicEndpoint data sheet.
Under the hood
One login experience. Your choice of backend.
On the phone, sign-in always looks the same: a prompt, a fingerprint, done. Underneath, MagicEndpoint lets you choose the cryptography that satisfies your security and compliance requirements — and change it by policy without retraining a single user.
What the user does — every time
-
1
Login triggers a prompt The Windows login screen reaches the MagicEndpoint app over Bluetooth or the network.
-
2
The user confirms presence Fingerprint or face on the phone — nothing typed on the endpoint.
-
3
The phone answers the challenge The response returns securely to the endpoint, which completes the login with Windows.
-
4
Windows unlocks The user is at their desktop in seconds.
The steps above never change. Only the cryptographic protocol on the right does — selected per user or group by policy.
What runs underneath
FIDO2 / Passkeys
Modern standardPublic-key authentication built on FIDO2 and WebAuthn.
- A hardware-backed private key on the phone or token signs a unique challenge for every login.
- No shared secret ever travels, so there is nothing reusable to phish or intercept.
- Runs over BLE, so it works offline as well as online.
Best for: new deployments, phishing-resistance mandates, and organizations standardizing on passkeys.
Certificate-based authentication
Enterprise & governmentX.509 certificates — on plastic or on the phone.
- Physical PIV smartcards and USB tokens for organizations mandated to use them.
- Or the phone emulates the smartcard over BLE — the same PKI trust without issuing hardware.
- Fits existing certificate lifecycles and high-assurance access-control policies.
Best for: PKI-standardized environments. Supported today; new rollouts are steered toward FIDO2 passkeys.
Password
Most widely usedThe native Windows credential — handled for the user, not by the user.
- The backend Windows has supported for decades and the one most organizations run today — no PKI to stand up, no certificates to issue or renew.
- Phone approval, TPM PIN, biometrics or a typed password with a second factor — these methods all complete the same proven Windows login underneath.
- With the phone app the experience is fully passwordless: the user approves the login and never types, sees or needs to know a password.
Best for: going passwordless on the Windows infrastructure you already have — with CBA and FIDO2 available whenever you standardize on them.
Which method uses which backend
| Login method | Backend | Connectivity |
|---|---|---|
| Passkey (phone app) | FIDO2 / WebAuthn | Offline or online (BLE) |
| CBA Phone (phone app) | X.509 virtual smartcard | Offline or online (BLE) |
| Smartcard / hardware token | X.509 (PIV) or FIDO | Offline or online |
| BLE Phone / Network Phone | Password — login completed after phone approval | BLE offline-capable / network online |
| TPM PIN | Password — PIN verified against the TPM | Offline or online |
| Biometric / Windows Hello | Password — biometric verified on the device | Offline or online |
| Password (+ push or biometric) | Password (+ second factor) | Push requires online |
Human fallback
Manager approval keeps people working
A lost phone should not mean a lost morning. Instead of a helpdesk ticket, a designated manager verifies the request in seconds — a human decision, cryptographically confirmed.
-
1
The user selects a manager at login
From the Windows login screen (or pre-boot), the user picks a designated approver instead of their usual method.
-
2
The manager sees the full context
The request arrives on the manager’s MagicEndpoint app with the time, user, computer name and location — enough to spot anything out of place.
-
3
Approve or deny, with biometrics
The manager confirms the decision with their own fingerprint or face, so approval itself is strongly authenticated.
-
4
The user is in
Access is granted for that login and normal methods resume once the user recovers their factor.
Built for the exceptions
Lost devices, forgotten tokens, recovery scenarios and high-trust environments — manager approval is the exception path that does not weaken the rule.
Fewer helpdesk tickets
Routing exceptions to a nearby manager instead of IT reduces helpdesk dependency and gets people back to work without a queue.
Also in the fallback chain
Self-help recovery, one-time passwords and an alternate password (for BLE users) can be enabled per method — so every login method ships with a recovery story.
Before Windows even loads
The same methods, one step earlier
With SecureDoc™ full-disk encryption, authentication can happen at pre-boot — while the disk is still encrypted and before the operating system exists to attack.
- Users authenticate at the pre-boot logon with the same methods they use at the Windows login screen — one habit, two checkpoints.
- Successful pre-boot authentication unlocks the encrypted disk and loads the operating system.
- With SSO enabled, the user lands directly on the desktop — the Windows login is skipped because it already happened at boot.
- PBConnex autoboot restarts servers, kiosks and remote devices unattended, authenticating at pre-boot without human interaction.
Platform coverage
Explore pre-boot authentication
Pre-boot authentication: Windows and Linux · Windows login: Windows. The layers are licensed independently and combine in any mix.
What login unlocks
Windows login is where the Live Key is born
A strong login is not the end of the story — it is the anchor for everything that follows. MagicEndpoint turns that one moment of verified identity into continuous, effortless access.
-
1
Strong MFA at pre-boot and/or Windows login
The user proves who they are once, with any of the methods above.
-
2
The TPM-bound Live Key is generated
At OS login, the verified user identity is combined with the device’s TPM to create the Live Key — a user-on-device identity that never leaves the endpoint.
-
3
A Trusted Channel is established
The endpoint maintains a cryptographically secure connection to the MagicEndpoint IdP, continuously verifying user, device and policy conditions — before, during and after every authentication.
-
4
Everything else signs in with No User Action
The endpoint authenticates on the user’s behalf to federated apps (SAML, OIDC, WS-FED), infrastructure protocols (RADIUS, LDAP, SSH, RDP) and even password-only apps via the built-in Password Manager.
Covers remote sessions too
Passwordless authentication is not limited to the local login — it extends to Windows Remote Desktop (RDP) and virtual desktop (VDI) sessions.
Works with your identity stack
MagicEndpoint runs as a standalone IdP or as a delegated IdP alongside your existing IAM, layering device trust and continuous verification on top — no rip-and-replace.
Microsoft Entra ID
Active Directory
Okta
Ping Identity
OneLogin
Protocols after login
SAML 2.0
OIDC
WS-FED
RADIUS
LDAP
SSH
RDP
Password Manager
Ready to take the password out of Windows login?
Schedule a demo or talk with one of our security experts to see MagicEndpoint at the login screen, at pre-boot and everywhere after.
Schedule a demo