Authentication Method Policy - Passkey (FIDO2)
FIDO2 security keys are hardware-based passwordless authentication devices that comply with the FIDO2 standard. They provide phishing-resistant, strong authentication and can be used as a primary or secondary factor for sign-in.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Method enabled | Specifies whether FIDO2 security key authentication method is enabled or disabled for the tenant. Learn more |
| Self-service registration allowed | Determines whether users can register new FIDO2 security keys on their own. Learn more |
| Attestation enforced | Determines whether attestation must be enforced for FIDO2 security key registration. Learn more |
| Key restrictions enforced | Controls whether key restrictions are enforced on FIDO2 security keys. Learn more |
| Included users | Groups and users explicitly included to use FIDO2 security key authentication. Learn more |
| Excluded users | Groups and users explicitly excluded from using FIDO2 security key authentication. Learn more |
Configure it
Add this to the tenant, or roll it out through a scheme, when you want to offer FIDO2 security keys and passkeys as a phishing-resistant sign-in method. They suit admins in particular, and anyone who can’t or won’t use a phone-based authenticator.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Turn on Method enabled, targeting all users under Included users so anyone can register a key or passkey, not only a pre-selected group.
-
Leave Self-service registration allowed on so people can add their own security key without raising a helpdesk ticket. Leave Attestation enforced and Key restrictions enforced off, so registration isn’t locked to a specific hardware vendor or model.
-
Save. Auto-remediation is safe to turn on here too: the baseline only adds a sign-in method, so reapplying it can’t lock anyone out of one they already use.
Check it worked
Passing means Entra ID → Authentication methods → Policies → Passkey (FIDO2) shows the method enabled for all users, with self-service registration on. Users can now go to their security info page and add a security key or platform passkey themselves; nothing changes for anyone who doesn’t.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.