Support for FIDO2 authentication with Microsoft Entra ID - Microsoft Entra ID (2024)

FAQs

Does Microsoft authenticator support FIDO2? ›

Microsoft Entra ID currently supports device-bound passkeys stored on FIDO2 security keys and in Microsoft Authenticator.

Microsoft Entra ID lets Authentication Policy Administrators choose which authentication methods can be used to sign in. They can enable Microsoft Authenticator in the Authentication methods policy to manage both the traditional push MFA method and the passwordless authentication method.

Click User Security Policies > User Account Settings. Select Yes in the Enable FIDO2 Authentication drop-down box. Select Yes in the Enable security key enrollment drop-down box. Enter a name in the FIDO2 Security Key Display Name field.

Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator. Browse to Protection > Authentication methods > Authentication method policy. Under the method FIDO2 security key, set the toggle to Enable.

With this news, any compatible device running Android 7.0+ were now FIDO2 Certified out of the box or after an automated Google Play Services update. This gives users the ability to leverage their FIDO security keys for secure passwordless access to websites and native applications that support the FIDO2 protocols."

FIDO2 is an open, license-free standard for multifactor passwordless authentication in mobile and desktop environments.

IT admins use Microsoft Entra ID to control access to apps and app resources, based on business requirements. For example, as an IT admin, you can use Microsoft Entra ID to require multifactor authentication when accessing important organizational resources.

Microsoft Entra ID is a cloud-based identity and access management solution. It's a directory and identity management service that operates in the cloud and offers authentication and authorization services to various Microsoft services, such as Microsoft 365, Dynamics 365, and Microsoft Azure.

Test Your Configurations in Microsoft Entra ID

Log in to Microsoft Entra ID at https://portal.azure.com/. Navigate to Azure Active Directory (Microsoft Entra ID) > Enterprise Applications. Select your app and navigate to Single Sign-on > Test SAML settings. Select the user that you want to log in as.

FIDO2 advantages

Replaces weak passwords with strong hardware-based authentication using public key crypto to protect against phishing, session hijacking, man-in-the-middle, and malware attacks. No secrets are shared between services.

What is an example of a FIDO2? ›

What are some examples of FIDO2 authentication methods? Biometric-capable devices and platform authenticators: These are built-in authenticators that require a biometric, PIN, or passcode. Examples include Apple's Touch ID and Face ID, Windows Hello, or Android fingerprint and face recognition.

Microsoft also supports FIDO2 passwordless login for Windows 10 with Azure AD. FIDO2 passwordless login allows roaming users to authenticate on any chosen Window 10 machine without having to set up Windows Hello.

The integration of Microsoft Authenticator with FIDO2 keys not only simplifies access to Microsoft applications but also strengthens the overall security infrastructure, introducing a phishing-resistant stack to iOS mobile platforms.

To get started, go to "Settings" → "Accounts" → "Sign-in options" → "Security Key" and click "Manage". Next, insert your key and follow the on-screen prompts to touch it in a timely manner. If you haven't already, you'll need to set up a PIN before registering a fingerprint.

FIDO2 security keys are an unphishable standards-based passwordless authentication method that can come in any form factor. They're commonly USB devices, but they can also use Bluetooth or near-field communication (NFC).

Microsoft and YubiKey work seamlessly together.

So you can already use FIDO U2F with very many services, among them are: Nextcloud, GitHub, Odoo, Gitlab, Facebook, Google and many more. Passwordless logins using FIDO2 are comparatively rare, e.g. at Microsoft or Nextcloud. We list an overview of compatible services on dongleauth.com.

Authenticator can be used three ways: As a way to verify sign in if you forget your password. As a way to sign every time, by using a one-time password code to increase account security. This is called two-step verification or multi-factor authentication.