Passkeys and FIDO2

This page's changes and edits · All guidance changes

Microsoft's edit · 19 Mar 20:20 UTC

Remove 'Enable passkeys (FIDO2) using Microsoft Graph API' section

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5d582de · +0 ~~−41~~ lines · also on GitHub

⋯ 79 unchanged lines

8080

8181 :::image type="content" border="true" source="media/how-to-enable-passkey-fido2/provision.png" alt-text="Conceptual diagram that shows the steps required to provision passkeys (FIDO2)." :::

8282

83 −## Enable passkeys (FIDO2) using Microsoft Graph API

84 −

85 −In addition to using the Microsoft Entra admin center, you can also enable passkeys (FIDO2) by using the Microsoft Graph API. To enable passkeys (FIDO2), you need to update the Authentication methods policy as at least an [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator).

86 −

87 −To configure the policy using Graph Explorer:

88 −

89 −1. Sign in to [Graph Explorer](https://aka.ms/ge) and consent to the **Policy.Read.All** and **Policy.ReadWrite.AuthenticationMethod** permissions.

90 −

91 −1. Retrieve the Authentication methods policy:

92 −

93 − ```json

94 − GET https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2

95 − ```

96 −

97 −1. To disable attestation enforcement and enforce key restrictions to only allow the AAGUID for RSA DS100 for example, perform a PATCH operation using the following request body:

98 −

99 − ```json

100 − PATCH https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2

101 −

102 − Request Body:

103 − {

104 − "@odata.type": "#microsoft.graph.fido2AuthenticationMethodConfiguration",

105 − "isAttestationEnforced": false,

106 − "keyRestrictions": {

107 − "isEnforced": true,

108 − "enforcementType": "allow",

109 − "aaGuids": [

110 − "7e3f3d30-3557-4442-bdae-139312178b39",

111 −

112 − <insert previous AAGUIDs here to keep them stored in policy>

113 − ]

114 − }

115 − }

116 − ```

117 −

118 −1. Make sure that the passkey (FIDO2) policy is updated properly.

119 −

120 − ```json

121 − GET https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2

122 − ```

123 −

12483 ## Delete a passkey (FIDO2)

12584

12685 To remove a passkey (FIDO2) associated with a user account, delete it from the user's authentication method.

⋯ 28 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.