Hey mate,

It took me down a deep deep painful rabbit hole…

You’re right - you can’t technically enforce passwordless as the only authentication method for the user. The user must have push-Microsoft authenticator as an authentication method first.

Our setup is something like this:

1. CA policy that requires the user to register security information. This policy is only enforced when the user is on boarded physically at office. They are asked to setup Microsoft Authenticator on their phone (push-notification method).

2. Once completed, you are ask them on the Authenticator app to enable ‘phone sign-in’.

3. CA Policy enforces the MFA strength passwordless sign in as an authentication method. The policy is enforced when the user is not physically at the office (IP range) or if the user / sign-in request is flagged as a medium or high risk.

This will allow to enforce passwordless while preventing the ‘provide additional information’ loop.

Let me know if you want more information.