---
updatedAt: 2026-03-25T20:55:27.000Z
---

# Configure passwordless authentication | BI On-prem

## What is passwordless authentication?

Passwordless authentication is a method of verifying a user’s identity without requiring a traditional password.

## How is it useful?

Passwordless authentication strengthens security, simplifies login, and reduces administrative effort, all while protecting against one of the biggest weaknesses in cybersecurity, passwords.

BeyondTrust supports FIDO2-certified authenticators to securely log in to BeyondInsight without entering your password. Roaming authenticators, such as YubiKeys, and platform integrated biometric authenticators, such as Windows Hello are supported.

> ℹ️
>
> Passwordless authentication is available only for local BeyondInsight users. Support for Active Directory, LDAP, and Entra ID directory users is planned for a future release.

## Enable passwordless authentication

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.
2. Enter your username and password.
3. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
4. Under **Authentication Management**,  select **Authentication Options**.\
   The **Authentication Options** page displays.
5. Under **Passwordless Authentication**:

   * Select the **Default Authentication Method**. This sets the default method displayed when logging into the console.

   * Check **Enable Passwordless FIDO2 Authentication** to enable it for BeyondInsight instance.

   * Click **Update Passwordless Authentication Settings** to save.

[block:image]{"images":[{"image":["https://files.readme.io/fe6a49791ec5f6c728a96b98676d09c5bcc1ee222a3e4501b5a65e92f9577e42-passwordless.png","","The Passwordless Authentication settings screen shows a dropdown labeled “Default Authentication Method,” set to “Username & Password.” Below it, a checked option labeled “Enable Passwordless FIDO2 Authentication” is displayed. A Save button appears at the bottom."],"align":"center","sizing":"45% ","border":true}]}[/block]

## Register a passwordless authenticator

1. In the top-right corner of the console, click  ![Profile icon](https://files.readme.io/01dbb8b9b064bd5d3c9537e43391877b45ac12c82f96d0a5d6bfca74bc9a09ca-profile.png) > **Account Settings**.\
   The **Account Settings** page displays.

2. Under **My Account**, click **Passwordless Authentication**.

3. Click **+ Register FIDO2 Authenticator**.

[block:image]{"images":[{"image":["https://files.readme.io/7b13f6337402edaca9a907e35fce08f0a4f0998bb527b81157d627c55a786520-fido2.png","","The Passwordless Authentication section of the My Account page is selected in the left menu. On the right, the Authenticators panel displays a button labeled “Register FIDO2 Authenticator.” The table below shows zero items with columns for Authenticator Name, Authenticator Type, Registered, and Last Used."],"align":"center","border":true}]}[/block]

4. Select the type of authenticator you wish to register: **Roaming** or **Platform**.

5. Enter a unique name for your authenticator.

6. Enter your BeyondInsight account password.

7. Click **Continue** and follow your browser's instructions.

[block:image]{"images":[{"image":["https://files.readme.io/96fd5c3023490528377226bbeeb548533291d668be8ea35f6cdfed5aacf4ab91-fido2a.png","","The “Register FIDO2 Authenticator” screen displays two authenticator type options: Roaming, which describes external FIDO2 security keys, and Platform, which describes built‑in biometric authenticators. The Roaming option is selected. Below the options are fields for Authenticator Name and Account Password. At the bottom are Continue and Cancel buttons."],"align":"center","sizing":"45% ","border":true}]}[/block]

## View and manage passwordless authenticators for users

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.
2. Enter your username and password.
3. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
4. Under **Role Based Access**,  select **User Management**.\
   The **User Management** page displays.
5. Select the **Users** tab.
6. Click ![Main menu icon](https://files.readme.io/a384447fc181d372b3c801a8c44a33b707ff1804087cd3f45d4842b8fd2a238a-columns.png) above the grid.
7. Select **Passwordless FIDO2 Authenticators** from the list to add that column to the grid.
8. The number of FIDO2 authenticators for each user is displayed in the column.
9. Locate a user in the grid.
10. Click ![Ellipsis icon](https://files.readme.io/4080ba090a69945563938a71f920a2637932c17f066cbf73b442f464af726c4e-ellipsis.png) **> View User Details**.
11. Under **User Details**, select **FIDO2 Authenticators**.
12. From the **FIDO2 Authenticators** grid, you can see the type of authenticator for each user, along with when it was registered, and last used.

## Delete an authenticator for a user

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.
2. Enter your username and password.
3. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
4. Under **Role Based Access**,  select **User Management**.\
   The **User Management** page displays.
5. Select the **Users** tab.
6. Locate a user in the grid.
7. Click ![Ellipsis icon](https://files.readme.io/4080ba090a69945563938a71f920a2637932c17f066cbf73b442f464af726c4e-ellipsis.png) **> View User Details**.
8. Under **User Details**, select **FIDO2 Authenticators**.
9. Locate the authenticator name in the grid.
10. Click ![Ellipsis icon](https://files.readme.io/4080ba090a69945563938a71f920a2637932c17f066cbf73b442f464af726c4e-ellipsis.png) **> Delete**.