EntraPass - Passkey Migration Assistant

?? Before You Start

EntraPass is an open-source (MIT) tool for assessing passkey readiness in your Microsoft Entra ID tenant.

? What this tool does:

Reads user profiles, devices, auth methods, and CA policies from your tenant via Microsoft Graph
Analyzes everything in your browser � no data leaves your machine
Deploys a temporary App Registration to your tenant for authentication

? Security & Privacy

All data stays in your browser's memory — nothing is stored on servers
The scanner creates a SPA (PKCE) app registration with no client secrets
You can delete the app registration after scanning using the cleanup script
No external API calls beyond Microsoft Graph

? Prerequisites

A Microsoft Entra ID tenant (the one you want to scan)
Permissions to create App Registrations (Application Developer role or higher)
Admin consent for Graph delegated permissions (or consent interactively)

I understand and acknowledge the above terms. I am authorized to scan this tenant.

?? Deploy Scanner to Your Tenant

EntraPass needs an App Registration in your tenant to run the scan. Two options:

?? Option 1: Deploy to Azure (Recommended)

Click the button below to open Azure Portal and deploy the Bicep template:

?? Deploy to Azure

You'll be prompted to select a Resource Group and provide:
- redirectUri: Your EntraPass portal URL (e.g., https://entrapass.pages.dev)
- tenantId: Your tenant ID

?? Option 2: Deploy via CLI

Or deploy from your terminal:

az deployment group create \
  --resource-group <your-rg> \
  --template-file infra/app-registration.bicep \
  --parameters redirectUri="https://entrapass.pages.dev" tenantId="<your-tenant-id>"

?? After deployment, come back here and click below.

?? Configure Your App Registration

Enter the values from your deployed App Registration.

Client ID (from Bicep output) Tenant ID (your directory ID) Portal URL (redirect URI)

?? Configuring...

Saving configuration...

?? EntraPass

?? Before You Start

? What this tool does:

? Security & Privacy

? Prerequisites

?? Deploy Scanner to Your Tenant

?? Option 1: Deploy to Azure (Recommended)

?? Option 2: Deploy via CLI

?? Configure Your App Registration

?? Configuring...

?? EntraPass

Passkey Migration Summary

User Passkey Readiness

?? Entra Tip: App Compatibility Check

Conditional Access Policy Analysis

?? AI Assistant