Passwordless Authentication & Immutable Identity

Configure cryptographic identity verification for workforce users, machines, workloads, and industrial endpoints.

What You’ll Achieve

Phishing-resistant access

Replace passwords with cryptographic proof tied to device + user context.

Immutable identity ledger

Write authentication and posture events to tamper-evident logs.

Unified policy enforcement

Apply consistent rules across enterprise endpoints and OT/edge nodes.

Prerequisites

QuantLayer Agent installed on endpoints (Windows, Linux, and supported OT/edge devices).
Device registered and visible under Assets & Devices with a healthy status (Connected / Registered).
Time sync enabled (NTP) for consistent audit timestamps (recommended for OT/ICS environments).
Admin role in QuantLayer to create policies and view identity events.

OT note

In segmented zones, deploy the identity service locally (on-prem) and allow only required east-west flows (zone-to-zone) via policy. This supports air-gapped or restricted OT networks.

Identity Flows Supported

Workforce: passwordless sign-in (FIDO2/passkeys), step-up policy based on risk.
Machine-to-machine: hardware-rooted device identity + mutual trust handshake.
Workloads: service identity for apps/agents with short-lived keys and rotation.
OT/ICS access: privileged remote access gated by device posture + zone policy.

Setup Steps

Create an Identity Policy specifying allowed factors and required device posture.
Bind the policy to a scope (Users, Devices, Groups, OT zones, or IoT fleet tags).
Enable Immutable Identity Logging to record auth events, key changes, and posture drift.
Test with a pilot group, then expand scope to production.

# QuantLayer Policy (illustrative)
policy "Passwordless + Device Trust" {
  require factor = "passkey";              # phishing-resistant
  require device.posture = "healthy";      # secure boot / agent ok
  require zone = ["IT", "OT-RemoteAccess"];# zone-aware

  when risk.score >= 70 {
    step_up factor = "hardware-key";       # optional step-up
    quarantine.session = true;              # contain until verified
  }

  log immutable = true;                     # write to identity ledger
}

Verify & Troubleshoot

Confirm device shows Last Authenticated updated after sign-in.
Check Identity Events for: key rotation, policy decisions, and posture signals.
If sign-in fails: validate device clock, agent health, and assigned policy scope.
For OT jump hosts: confirm allowed conduits and local policy service reachability.

Next Steps

Create an Identity Policy.
View Identity Events.
Download PDF.

Best practice

Treat identity as a continuous signal: re-check posture at session start, during access, and on policy-relevant events (e.g., config changes, drift, new binaries).