823 karma · joined June 15, 2015
1. Verification of the legitimacy of the passkey. 2. Passkeys are a support nightmare if you don't restrict what can be used, and the only way to restrict is by using attestation.
If you don't restrict down, there is nothing stopping someone from setting up a passkey in Edge or Chrome or Windows Hello (not Windows Hello for business), and depending on what device or profile they are signed into, when they go onto another device, no passkey.
If someone is a single device user and only uses their corp device to access, and the corp only cares about phishing resistant MFA from an Entra perspective, as part of the auth strength configuration, Windows Hello for Business is enabled by default.
Alternatively you can build your own with MS Graph Data Connect but also it costs.
You can turn this off, but last I checked can also set it to stuff like Google Meet, Zoom, WebEx, Facetime, etc if you have the relevant plug-in for Outlook.
Any company that has compliance requirements to keep devices supported with security updates, it's the same as Win 7 to Win 10; you either update everyone to Win 11 or you pay for the security updates for Win 10 (IIRC you have 3 years to update before you can't pay anymore). Many will likely already be on Win 11 as the upgrade path is easier/quicker than Win 7 to 10.
Also they will not have the gunk installed anyway as they will almost certainly have Windows Enterprise which has more policies that can be set, and then they will also be ordering devices from an OEM or distributor that doesn't have the junk included.
Heck, if they aren't doing Autopilot from the OEM or distributor, they will almost certainly be applying their own Windows image.