An organization wants to transition its warehouse staff away from traditional passwords to improve security and streamline login times. The warehouse staff frequently rotate shifts and share dedicated Windows workstations to access web-based corporate applications. Which passwordless authentication method should the organization implement to meet these requirements?

FIDO2 security keys: ### What FIDO2 Security Keys Are **FIDO2 security keys** (also referred to as passkeys) are external hardware devices—typically USB or NFC tokens such as YubiKeys—that provide strong, standards-based **passwordless authentication**. They allow users to securely sign in to Microsoft Entra ID accounts and web-based applications without ever typing a username or password. ### How It Meets the Shared Workstation Requirement In environments with **shared workstation PCs** where multiple employees rotate shifts, individual biometric setups like Windows Hello for Business tied to personal devices are not practical. FIDO2 security keys are completely portable; an employee simply inserts their physical security key into the shared PC, provides their personal PIN or gesture on the hardware token, and gains instant, passwordless access to corporate cloud resources. ### Key Advantages and Capabilities - **Phishing-resistant security**: Eliminates password-based vulnerabilities such as credential harvesting, replay attacks, and brute-force attempts. - **Shared PC optimization**: Enables smooth user rotation on shared devices without storing credentials locally across sessions. - **Standards-based interoperability**: Adheres to Fast Identity Online (FIDO) Alliance specifications across modern browsers and operating systems. - **Hardware-bound protection**: The cryptographic private key never leaves the secure element of the physical device. - **Streamlined user experience**: Replaces cumbersome passwords with a simple physical touch and PIN verification. ### Why This Is Optimal FIDO2 security keys represent the industry gold standard for hardware-based passwordless authentication on shared physical infrastructure, providing maximum protection while dramatically speeding up the sign-in workflow.