Your company has a Microsoft Entra tenant named contoso.com and a Microsoft 365 subscription. All users use Windows 10 devices to access Microsoft Office 365 apps. All the devices are in a workgroup.

Joining all devices to contoso.com (Azure AD Join) would enable Windows Hello for Business for passwordless sign-in, but it represents a significant infrastructure change for workgroup devices and is not the simplest direct recommendation for passwordless access to Microsoft 365 apps.

Microsoft Entra Application Proxy is used to provide secure remote access to on-premises web applications for external users, and it does not directly facilitate passwordless sign-in for Microsoft 365 apps.

Deploying X.509.3 certificates for certificate-based authentication (CBA) can offer passwordless sign-in, but it is a complex and resource-intensive solution for a workgroup environment compared to simply deploying the Authenticator app.

The Microsoft Authenticator app enables passwordless phone sign-in, allowing users to authenticate by approving a notification on their mobile device instead of entering a password. This method is highly recommended for its security and convenience, and it works independently of whether the devices are joined to Azure AD or remain in a workgroup.