Passkeys and FIDO2
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 83d9df2 · +56 −0 lines · also on GitHub
⋯ 64 unchanged lines
6565
> [!NOTE]
6666
> If you disable synced passkeys for a given passkey profile, targeted users can't sign in with a synced passkey even if they already registered one.
6767
68
+## Provision FIDO2 security keys using Microsoft Graph API (preview)
69
+
70
+Currently in preview, administrators can use [Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users](https://aka.ms/passkeyprovision). Provisioning requires the [Authentication Administrator role](/entra/identity/role-based-access-control/permissions-reference#authentication-administrator) or a client application with UserAuthenticationMethod.ReadWrite.All permission. The provisioning improvements include:
71
+
72
+- The ability to request WebAuthn **creation Options** from Microsoft Entra ID
73
+- The ability to register the provisioned security key directly with Microsoft Entra ID
74
+
75
+With these new APIs, organizations can build their own clients to provision passkey (FIDO2) credentials on security keys on behalf of a user. To simplify this process, three main steps are required.
76
+
77
+1. **Request** creationOptions for a user: Microsoft Entra ID returns the necessary data for your client to provision a passkey (FIDO2) credential. This includes information such as user information, relying party ID, credential policy requirements, algorithms, registration challenge and more.
78
+2. **Provision** the passkey (FIDO2) credential with the creation Options: Use the `creationOptions` and a client that supports the Client to Authenticator Protocol (CTAP) to provision the credential. During this step, you need to insert the security key and set a PIN.
79
+3. **Register** the provisioned credential with Microsoft Entra ID: Use the formatted output from the provisioning process to provide Microsoft Entra ID the necessary data to register the passkey (FIDO2) credential for the targeted user.
80
+
81
+:::image type="content" border="true" source="media/how-to-enable-passkey-fido2/provision.png" alt-text="Conceptual diagram that shows the steps required to provision passkeys (FIDO2)." :::
82
+
83
+## Enable passkeys (FIDO2) using Microsoft Graph API
84
+
85
+In addition to using the Microsoft Entra admin center, you can also enable passkeys (FIDO2) by using the Microsoft Graph API. To enable passkeys (FIDO2), you need to update the Authentication methods policy as at least an [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator).
86
+
87
+To configure the policy using Graph Explorer:
88
+
89
+1. Sign in to [Graph Explorer](https://aka.ms/ge) and consent to the **Policy.Read.All** and **Policy.ReadWrite.AuthenticationMethod** permissions.
90
+
91
+1. Retrieve the Authentication methods policy:
92
+
93
+ ```json
94
+ GET https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2
95
+ ```
96
+
97
+1. To disable attestation enforcement and enforce key restrictions to only allow the AAGUID for RSA DS100 for example, perform a PATCH operation using the following request body:
98
+
99
+ ```json
100
+ PATCH https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2
101
+
102
+ Request Body:
103
+ {
104
+ "@odata.type": "#microsoft.graph.fido2AuthenticationMethodConfiguration",
105
+ "isAttestationEnforced": false,
106
+ "keyRestrictions": {
107
+ "isEnforced": true,
108
+ "enforcementType": "allow",
109
+ "aaGuids": [
110
+ "7e3f3d30-3557-4442-bdae-139312178b39",
111
+
112
+ <insert previous AAGUIDs here to keep them stored in policy>
113
+ ]
114
+ }
115
+ }
116
+ ```
117
+
118
+1. Make sure that the passkey (FIDO2) policy is updated properly.
119
+
120
+ ```json
121
+ GET https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2
122
+ ```
123
+
68124
## Delete a passkey (FIDO2)
69125
70126
To remove a passkey (FIDO2) associated with a user account, delete it from the user's authentication method.
⋯ 28 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.