Passwordless Sign-in with a FIDO2 Security Key (Yubico) in Microsoft Entra ID

Platforms

WindowsmacOS

Products

Entra IDIntuneYubico

Result

Users sign in with a security key and PIN on the web, during Windows enrollment and at Windows sign-in

Overview

Sign in to Microsoft Entra ID, Windows enrollment, Autopilot and Windows Hello for Business with a Yubico FIDO2 security key instead of a password.

Passwords are a weak form of authentication: malware, phishing and password-guessing attacks such as brute force can expose them. Passwordless sign-in is a strong, device-based alternative. With Microsoft Entra ID (formerly Azure AD) users can sign in with:

• Windows Hello for Business
• Microsoft Authenticator (passwordless phone sign-in or a passkey in the app)
• passkeys (FIDO2) on a FIDO2 security key

FIDO2 is an open authentication standard from the FIDO Alliance. It combines Web Authentication (WebAuthn) and the Client to Authenticator Protocol (CTAP), and it works with older Universal 2nd Factor (U2F) keys. A security key uses hardware and public-key cryptography to defend against phishing and account takeover. Microsoft Entra ID stores the public key for your account, and the private key never leaves the security key. Microsoft now calls this a passkey: a security key holds a device-bound passkey.

Users register the key and then pick it on the sign-in screen as their main sign-in method. Most FIDO2 keys are USB devices, but some also use NFC (Near Field Communication) or Bluetooth Low Energy. There is no password that could be exposed or guessed.

In this post I test the Yubico Security Key C NFC for passwordless sign-in to Microsoft Entra ID. It supports FIDO2 (WebAuthn) and FIDO U2F over USB-C (Windows, Mac) and NFC (iOS, Android). I also tested other keys with IDmelon and Feitian.

Prerequisites

Before you start, check that you have the following.

Configuration

Enable the method, let users register their keys, then allow security keys for Windows sign-in.

Step	Console	What you set
3.1	Entra	Passkey (FIDO2) authentication method policy
3.2	My Sign-Ins	The user registers the security key
3.3	Intune	Windows Hello for Business: use security keys for sign-in (optional)

Enable passkeys (FIDO2) in Microsoft Entra ID

Microsoft Entra admin center

In the Microsoft Entra admin center (entra.microsoft.com) go to Entra ID > Authentication methods > Policies > Passkey (FIDO2). In 2022 the method was called FIDO2 Security Key and the portal was the Azure AD admin center (see Enable passkeys (FIDO2)):

On the Enable and target tab (in 2022: Basics) set:

• Enable: On
• Target: All users, or a group of users

On the Configure tab:

• Allow self-service set up: Yes, so users can register keys themselves
• Enforce attestation: Yes, to allow only genuine keys from known vendors. It is checked only when a key is registered.
• Enforce key restrictions: No, or Yes to allow or block specific key models by their AAGUID

Microsoft now groups attestation, passkey types (device-bound or synced) and key restrictions into passkey profiles; your old settings become the default profile. For security keys only, choose the Device-bound passkey type. The Yubico key is on Microsoft's list of attested FIDO2 authenticators as Security Key NFC by Yubico:

Register the security key

My Sign-Ins

The user signs in to mysignins.microsoft.com/security-info (in 2022: myprofile.microsoft.com) and selects Add sign-in method > Passkey. In 2022 the method was Security key. The user must have completed MFA in the last 5 minutes (see Register a passkey with a security key):

In 2022 the user chose between a USB and an NFC device. Today the browser or Windows shows its own passkey dialog, where you choose Security key:

For a USB key, the user sets or enters the key PIN and touches the key to finish:

Optional: allow security keys for Windows sign-in

Intune admin center

To let users sign in to Windows with a security key, go to the Intune admin center (intune.microsoft.com) > Devices > Enroll devices > Windows enrollment > Windows Hello for Business and set Use security keys for sign-in to Enabled. This tenant-wide setting applies only when devices enroll (see tenant-wide Windows Hello for Business policy):

For devices that are already enrolled, use an Account protection policy under Endpoint security, or a custom profile with this OMA-URI and the integer value 1 (see security key sign-in to Windows):

./Device/Vendor/MSFT/PassportForWork/SecurityKey/UseSecurityKeyForSignin

Note: security key sign-in to Windows doesn't depend on Windows Hello for Business being configured.

User Experience

I tested the key on the web, during Windows enrollment and at Windows sign-in.

With a USB security key plugged in, the Windows sign-in screen shows an extra sign-in option:

I tested five sign-in scenarios with the security key in 2022:

1. Windows 11 and Microsoft Edge: sign in to Outlook on the web
2. macOS 12 and Microsoft Edge: sign in to Outlook on the web
3. Windows 11 enrollment from the out-of-box experience (OOBE), without Autopilot
4. Windows 11 Autopilot enrollment
5. Windows Hello for Business setup and sign-in

1. Windows 11 and Microsoft Edge: Outlook on the web

The experience depends on the browser; see the supported browsers. The user selects Sign in with a security key (today: Sign-in options > Face, fingerprint, PIN or security key):

The user enters the security key PIN:

and touches the key to unlock the private key on it:

If the key holds more than one account, the user picks the account:

Sign-in is successful:

2. macOS 12 and Microsoft Edge: Outlook on the web

The user selects Sign in with Windows Hello or a security key:

and chooses USB security key:

The user enters the key PIN:

and touches the key:

The user is signed in:

3. Windows 11 enrollment from OOBE (without Autopilot)

The user selects Sign in with a security key:

enters the key PIN:

and touches the key:

If the key holds several accounts (for example an admin and a standard account), the user picks the right one:

Enrollment starts:

4. Windows 11 Autopilot enrollment

The device recognises that it is registered in Autopilot and asks the user to sign in:

The user selects Sign in with a security key:

enters the key PIN:

and touches the key:

Autopilot device preparation and setup begin:

5. Windows Hello for Business

After enrollment, the user sees the Windows Hello setup screen:

The user verifies their identity with the security key:

enters the key PIN:

and touches the key:

Then the user sets a Windows Hello PIN that meets your organisation's rules:

All set:

The next time the user signs in to Windows 11, they can choose the FIDO2 security key or the Windows Hello PIN under Sign-in options: