Custom Conditional Access authentication strengths
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 568974d · +12 −12 lines · also on GitHub
11
---
2
−title: Overview of custom authentication strengths and advanced options for FIDO2 security keys and certificate-based authentication in Microsoft Entra ID
3
−description: Learn how admins can create custom authentication strengths with advanced options for FIDO2 security keys and certificate-based authentication.
2
+title: Overview of custom authentication strengths and advanced options for passkey (FIDO2) and certificate-based authentication in Microsoft Entra ID
3
+description: Learn how admins can create custom authentication strengths with advanced options for passkey (FIDO2) security keys and certificate-based authentication.
44
ms.service: entra-id
55
ms.subservice: authentication
66
ms.topic: article
7
−ms.date: 03/04/2025
7
+ms.date: 09/15/2025
88
ms.author: justinha
99
author: inbarckms
1010
manager: dougeby
⋯ 20 unchanged lines
3131
To check if an authentication strength is referenced by a Conditional Access policy, click the **Conditional Access policies** column.
3232
3333
34
−## FIDO2 security key advanced options
35
−You can restrict the usage of FIDO2 security keys based on their Authenticator Attestation GUIDs (AAGUIDs). This capability allows administrators to require a FIDO2 security key from a specific manufacturer in order to access the resource. To require a specific FIDO2 security key, first create a custom authentication strength. Then select **FIDO2 Security Key**, and click **Advanced options**.
34
+## Passkey (FIDO2) advanced options
35
+You can restrict the usage of passkeys (FIDO2) based on their Authenticator Attestation GUIDs (AAGUIDs). This capability allows administrators to require a FIDO2 security key from a specific manufacturer in order to access the resource. To require a specific FIDO2 security key, first create a custom authentication strength. Then select **Passkeys (FIDO2)**, and click **Advanced options**.
3636
37
−:::image type="content" border="true" source="./media/concept-authentication-strengths/key.png" alt-text="Screenshot showing Advanced options for FIDO2 security key.":::
37
+:::image type="content" border="true" source="./media/concept-authentication-strengths/key.png" alt-text="Screenshot showing Advanced options for passkey (FIDO2).":::
3838
39
−Next to **Allowed FIDO2 Keys** click **+**, copy the AAGUID value, and click **Save**.
39
+Next to **Add AAGUID**, click **+**, copy the AAGUID value, and click **Save**.
4040
4141
:::image type="content" border="true" source="./media/concept-authentication-strengths/guid.png" alt-text="Screenshot showing how to add an Authenticator Attestation GUID.":::
4242
⋯ 79 unchanged lines
122122
123123
## Limitations
124124
125
−### FIDO2 security key advanced options
126
−- FIDO2 security key Advanced options - Advanced options aren't supported for external users with a home tenant that is located in a different Microsoft cloud than the resource tenant.
125
+### Passkeys (FIDO2) Advanced options
126
+- Passkeys (FIDO2) Advanced options - Advanced options aren't supported for external users with a home tenant that is located in a different Microsoft cloud than the resource tenant.
127127
128128
### Certificate-based authentication advanced options
129129
⋯ 17 unchanged lines
147147
148148
## Troubleshooting authentication strength advanced options
149149
150
−### Users can't use their FIDO2 security key to sign in
151
−A Conditional Access Administrator can restrict access to specific security keys. When a user tries to sign in by using a key they can't use, this **You can't get there from here** message appears. The user has to restart the session, and sign-in with a different FIDO2 security key.
150
+### Users can't use their passkey (FIDO2) to sign in
151
+A Conditional Access Administrator can restrict access to specific security keys. When a user tries to sign in by using a key they can't use, this **You can't get there from here** message appears. The user has to restart the session, and sign-in with a different passkey (FIDO2).
152152
153
−:::image type="content" border="true" source="./media/troubleshoot-authentication-strengths/restricted-security-key.png" alt-text="Screenshot of a sign-in error when using a restricted FIDO2 security key.":::
153
+:::image type="content" border="true" source="./media/troubleshoot-authentication-strengths/restricted-security-key.png" alt-text="Screenshot of a sign-in error when using a restricted passkey (FIDO2).":::
154154
155155
156156
### How to check certificate policy OIDs and issuer
⋯ 11 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.