Reduce the user-visible password surface area

Overview

Organizations with extensive user-facing password surfaces expose multiple entry points for credential-based attacks. Threat actors often begin with credential stuffing using compromised credentials from data breaches, followed by password spraying to test common passwords across multiple accounts. Once initial access is gained, they conduct credential discovery by examining browser password stores, cached credentials in memory, and credential managers to harvest additional authentication materials. These stolen credentials enable lateral movement to more systems and applications, often escalating privileges by targeting administrative accounts that still rely on password authentication.

Without passwordless methods like Windows Hello for Business, FIDO2 security keys, and Microsoft Authenticator deployed broadly, every password prompt is an opportunity for interception and exploitation. Reducing the password surface area limits these attack vectors and reduces the overall exposure to credential-based threats.

Remediation

• Plan a phishing-resistant passwordless authentication deployment.
• Enable passkeys (FIDO2).
• Configure Windows Hello for Business.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Medium
Impact on users	Medium
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	Authentication methods
Area	Authentication
ATT&CK	T1110.003 Password Spraying, T1110.004 Credential Stuffing, T1078.004 Cloud Accounts
Licence	P1
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.