Your company has a Microsoft Entra tenant named contoso.com and a Microsoft 365 subscription. All users use Windows 10 devices to access Microsoft Office 365 apps. All the devices are in a…

Devices must be Microsoft Entra joined or Hybrid Microsoft Entra joined to use passwordless authentication methods like Windows Hello for Business or FIDO2 security keys for sign-in, as these methods rely on device registration and trust with Microsoft Entra ID. Since the devices are currently in a workgroup, joining them to contoso.com (Microsoft Entra ID) establishes the necessary trust and enables the use of these authentication options for passwordless sign-in to Entra ID resources.

Microsoft Entra Application Proxy provides secure remote access to on-premises web applications and is not directly related to enabling passwordless sign-in for Windows 10 devices to Microsoft Entra ID itself.

The Microsoft Entra Connect provisioning agent is used for HR-driven provisioning or cloud sync to synchronize identities from on-premises directories to Microsoft Entra ID, which is not required for enabling passwordless sign-in for existing Microsoft Entra users.

Deploying the Microsoft Authenticator app is a component of some passwordless methods (e.g., phone sign-in), but it does not address the fundamental requirement of enabling workgroup devices for passwordless sign-in to Microsoft Entra ID, which first requires device registration.