Users have RFID badges we can read with a badge reader to get a badge unqiue ID at a kiosk. We store the badge uniqueID as a custom schema extension attribute in AAD. We can use Graph API to look up the user in AAD. So now we know who the owner of the badge is.
How can we create a session/access token for the user without prompting for password? i.e. trust the badge - single factor instead of MFA. Yes we know it's not perfect security and someone else could have the users badge.
