Passkeys and FIDO2
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7830def · +11 −0 lines · also on GitHub
⋯ 27 unchanged lines
2828
> [!NOTE]
2929
> Treat synced passkeys as phishing-resistant credentials but with the same security posture as other unattested authenticators.
3030
31
+## Passkey (FIDO2) Authenticator Attestation GUID (AAGUID)
32
+
33
+The FIDO2 specification requires each security key vendor to provide an Authenticator Attestation GUID (AAGUID) during registration. An AAGUID is a 128-bit identifier indicating the key type, such as the make and model. Passkey (FIDO2) providers on desktop and mobile devices are also expected to provide an AAGUID during registration.
34
+
35
+>[!NOTE]
36
+>The vendor must ensure that the AAGUID is identical across all substantially identical security keys or passkey (FIDO2) providers made by that vendor, and different (with high probability) from the AAGUIDs of all other types of security keys or passkey (FIDO2) providers. To ensure this, the AAGUID for a given security key model or passkey (FIDO2) provider should be randomly generated. For more information, see [Web Authentication: An API for accessing Public Key Credentials - Level 2 (w3.org)](https://w3c.github.io/webauthn/).
37
+
38
+You can work with your security key vendor to determine the AAGUID of the passkey (FIDO2), or see [FIDO2 security keys eligible for attestation with Microsoft Entra ID](~/identity/authentication/concept-fido2-hardware-vendor.md#fido2-security-keys-eligible-for-attestation-with-microsoft-entra-id). If the passkey (FIDO2) is already registered, you can find the AAGUID by viewing the authentication method details of the passkey (FIDO2) for the user.
39
+
40
+
41
+
3142
## Requirements
3243
3344
- Your organization must have [Passkey profiles](how-to-authentication-passkey-profiles.md) enabled.
⋯ 54 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.