# Authentication Method Policy - Passkey (FIDO2)

> FIDO2 security keys are hardware-based passwordless authentication devices that comply with the FIDO2 standard.

FIDO2 security keys are hardware-based passwordless authentication devices that comply with the FIDO2 standard. They provide phishing-resistant, strong authentication and can be used as a primary or secondary factor for sign-in.

## Settings this baseline controls

| Setting                           | What it does                                                                                                                                                                                                 |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Method enabled                    | Specifies whether FIDO2 security key authentication method is enabled or disabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration) |
| Self-service registration allowed | Determines whether users can register new FIDO2 security keys on their own. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration)                       |
| Attestation enforced              | Determines whether attestation must be enforced for FIDO2 security key registration. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration)              |
| Key restrictions enforced         | Controls whether key restrictions are enforced on FIDO2 security keys. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration)                            |
| Included users                    | Groups and users explicitly included to use FIDO2 security key authentication. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration)                    |
| Excluded users                    | Groups and users explicitly excluded from using FIDO2 security key authentication. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/fido2authenticationmethodconfiguration)                |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this to the tenant, or roll it out through a scheme, when you want to offer FIDO2 security keys and passkeys as a phishing-resistant sign-in method. They suit admins in particular, and anyone who can't or won't use a phone-based authenticator.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn on **Method enabled**, targeting all users under **Included users** so anyone can register a key or passkey, not only a pre-selected group.
3. Leave **Self-service registration allowed** on so people can add their own security key without raising a helpdesk ticket. Leave **Attestation enforced** and **Key restrictions enforced** off, so registration isn't locked to a specific hardware vendor or model.
4. Save. **Auto-remediation** is safe to turn on here too: the baseline only adds a sign-in method, so reapplying it can't lock anyone out of one they already use.

## Check it worked

Passing means **Entra ID → Authentication methods → Policies → Passkey (FIDO2)** shows the method enabled for all users, with self-service registration on. Users can now go to their security info page and add a security key or platform passkey themselves; nothing changes for anyone who doesn't.

## Standards this addresses

### CIS

- **M365 5.2.3.x** — CIS M365 Foundations Benchmark 5.2.3.x
- **v8 6.3** — CIS Controls v8 Safeguard 6.3

### NIST

- **PR.AC-7** — NIST CSF 2.0 PR.AC-7
- **IA-2** — NIST SP 800-53 IA-2
- **IA-5** — NIST SP 800-53 IA-5

### ISO 27001

- **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)