Does anyone have a good guide for setting up Entra ID to do passwordless authentication with NetScaler ADC SAML? For some reason a security team doesn't want people to put in password and security tokens for MFA, but want to do Tokens only.

If I’m not mistaken, most of that config will need to be done in Entra ID. Not the biggest expert on that, but NetScaler-wise it is just SAML SP (+FAS for CVAD)

So entra as the idp?

Yeah, this will all be Entra ID stuff. I can just do basic setup and Conditional Based Access, but can't seem to locate where in that Enterprise App you would set this up.

Do you have fas working yet?

Yup, it's all working right now with username, password, mfa. They just want to change it on the Entra side to do Windows Hello, instead of username, password, mfa.

In the Conditional Access area in Entra ID, there is Authentication Strenghts Policies were you can define the auth-method (Passwordless). Bind that authentication strenghts policy to the CA policy where the NetScaler Enterprise App is linked to.

I can get directions when I finish flying g if someone doesn't hook you.up

I found it for my lab stuff. Need to setup my domain machine to fully integrate. Thanks for the info!

There's a lot of passwordless going around and I get that. Once you get your head around it, it definitely improves the user experience!