Microsoft has begun testing an expansion of its Web sign-in credential provider, bringing passwordless authentication options to Microsoft Entra hybrid-joined Windows 11 PCs. The new functionality, made available in Windows 11 Insider Preview Build 26340.9750, allows enterprise users on hybrid domain-joined machines to log in directly at the lock screen without entering a traditional user password.

Previously restricted strictly to cloud-native Microsoft Entra-joined endpoints, the feature marks a significant milestone for enterprise security architectures. By opening Web sign-in to hybrid environments, system administrators can now deploy modern authentication controls across legacy corporate networks while preserving seamless local access to on-premises resources.

Microsoft Extends Web Sign-In to Entra Hybrid-Joined PCs

The expansion specifically addresses organizations operating in a hybrid state, where hardware is registered with both an on-premises Active Directory infrastructure and cloud-based Microsoft Entra ID. Prior to this preview build, IT teams attempting to deploy passwordless web login flows on hybrid machines were unable to do so, limiting passwordless adoption to fully migrated cloud endpoints.

With this release, Windows 11 introduces parity between cloud-only and hybrid deployments at the lock screen. This change is intended to streamline corporate onboarding, lower helpdesk costs tied to password resets, and help companies phase out weak or easily phished passwords across their entire fleet.

Supported Passwordless Authentication Methods

Under the updated credential provider, end users signing in to a hybrid PC can choose from several cloud-backed authentication options:

  • FIDO2 Security Keys: Hardware-based security keys that deliver phishing-resistant multi-factor authentication.
  • Mobile Passkeys: Cryptographic credentials stored on mobile devices, allowing users to verify sign-ins using biometric prompts on their smartphone.
  • Temporary Access Pass (TAP): Time-limited passcodes generated by administrators for initial device provisioning or emergency account recovery.

Because these methods execute inside an embedded browser instance directly on the lock screen, authentication flows align with standard Microsoft Entra ID web portals.

Technical Workflow and Kerberos Integration

A central technical hurdle for hybrid environments has always been maintaining access to local network shares and legacy line-of-business applications after cloud authentication. Microsoft resolves this in the preview build by automatically negotiating on-premises credentials immediately after a successful web sign-in session.

When an employee authenticates via Web sign-in on an Entra hybrid-joined PC, Windows requests a Kerberos ticket in the background through the cloud identity provider. This process ensures that the local device receives valid Active Directory tickets, granting uninterrupted access to corporate file servers, local printers, and internal intranet portals without requiring an additional password prompt.

Administrators can manage the feature using existing Mobile Device Management (MDM) tools such as Microsoft Intune. Configuration is handled via the Settings Catalog profile setting designated as EnableWebSignIn under the Authentication CSP node.

Impact on Enterprise Security and IT Administration

For enterprise IT administrators, the update removes one of the major remaining blockers to going fully passwordless in hybrid topologies. Hybrid organizations often struggled with account recovery scenarios, such as when a user forgot their password or experienced a corrupted Windows Hello for Business PIN container while away from the office network. In such cases, issuing a Temporary Access Pass (TAP) over the web allows instant recovery.

This deployment coincides with ongoing updates to administrative and shell features across the operating system. Microsoft recently introduced major updates across the ecosystem, ranging from redesigned taskbar search settings to improved background system performance. Organizations managing updates should keep in mind that testing in preview channels remains critical, especially given past cumulative update quirks such as enterprise network connectivity bugs affecting enterprise Wi-Fi protocols.

While the feature offers obvious security advantages, administrators should note that Web sign-in requires an active internet connection to contact Microsoft Entra endpoints. Devices operating fully offline will still require cached credentials or traditional fallback authentication providers like Windows Hello for Business or local PINs. Furthermore, IT departments keeping track of platform lifecycles should remember that keeping systems current on active builds, such as monitoring the end of support for older Windows 11 versions, is essential for maintaining credential provider compatibility.

The passwordless Web sign-in capability for Entra hybrid PCs is currently rolling out to members of the Windows Insider Program in the Experimental Channel. Microsoft is expected to evaluate administrator feedback and operational telemetry before rolling out the credential update to general availability in an upcoming Windows 11 servicing release.