Passkeys in Microsoft Authenticator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c2d7055 · +3 −48 lines · also on GitHub
⋯ 40 unchanged lines
4141
1. Under the method **Passkey (FIDO2)**, select **All users** or **Add groups** to select specific groups. *Only security groups are supported*.
4242
1. On the **Configure** tab:
4343
- Set **Allow self-service set up** to **Yes**. If it's set to **No**, users can't register a passkey by using [Security info](https://mysignins.microsoft.com/security-info), even if passkeys (FIDO2) are enabled by the Authentication methods policy.
44
− - Set **Enforce attestation** to **Yes** or **No**.
44
+ - Set **Enforce attestation** to **Yes** or **No**. Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.
4545
4646
When attestation is enabled in the passkey (FIDO2) policy, Microsoft Entra ID tries to verify the legitimacy of the passkey being created. When the user is registering a passkey in the Authenticator, attestation verifies that the legitimate Authenticator app created the passkey by using Apple and Google services. Here are more details:
4747
⋯ 6 unchanged lines
5454
> [!NOTE]
5555
> For both iOS and Android, Authenticator attestation relies upon Apple and Google services to verify the authenticity of the Authenticator app. Heavy service usage can make passkey registration fail, and users might need to try again. If Apple and Google services are down, Authenticator attestation blocks registration that requires attestation until services are restored. To monitor the status of Google Play Integrity service, see [Google Play Status Dashboard](https://status.play.google.com/). To monitor the status of the iOS App Attest service, see [System Status](https://developer.apple.com/system-status/).
5656
57
− > [!NOTE]
58
− > Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.
5957
58
+
6059
- **Key restrictions** set the usability of specific passkeys for both registration and authentication. You can set **Enforce key restrictions** to **No** to allow users to register any supported passkey, including passkey registration directly in the Authenticator app. If you set **Enforce key restrictions** to **Yes** and already have active passkey usage, you should collect and add the AAGUIDs of the passkeys being used today.
6160
61
+
6262
If you set **Restrict specific keys** to **Allow**, select **Microsoft Authenticator** to automatically add the Authenticator app AAGUIDs to the key restrictions list. You can also manually add the following AAGUIDs to allow users to register passkeys in Authenticator by signing in to the Authenticator app or by going through a guided flow on **Security info**:
6363
6464
- **Authenticator for Android**: `de1e552d-db1d-4423-a619-566b625cdc84`
⋯ 52 unchanged lines
117117
GET https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2
118118
```
119119
120
−## Find AAGUIDs
121
−
122
−Use the `GetRegisteredPasskeyAAGUIDsForAllUsers.ps1` Microsoft Graph PowerShell script to enumerate the AAGUIDs of all registered passkeys in the tenant.
123
−
124
−Save the body of this script to a file called `GetRegisteredPasskeyAAGUIDsForAllUsers.ps1`.
125
−
126
−```powershell
127
−# Disconnect from Microsoft Graph
128
−Disconnect-MgGraph
129
−
130
−# Connect to Microsoft Graph with required scopes
131
−Connect-MgGraph -Scope 'User.Read,UserAuthenticationMethod.Read,UserAuthenticationMethod.Read.All'
132
−
133
−# Define the output file [If the script is run more than once, delete the file to avoid appending to it.]
134
−$file = ".\AAGUIDs.txt"
135
−
136
−# Initialize the file with a header
137
−Set-Content -Path $file -Value '---'
138
−
139
−# Retrieve all users
140
−$UserArray = Get-MgBetaUser -All
141
−
142
−# Iterate through each user
143
−foreach ($user in $UserArray) {
144
− # Retrieve Passkey authentication methods for the user
145
− $fidos = Get-MgBetaUserAuthenticationFido2Method -UserId $user.Id
146
−
147
− if ($fidos -eq $null) {
148
− # Log and write to file if no Passkey methods are found
149
− Write-Host "User object ID $($user.Id) has no Passkey"
150
− Add-Content -Path $file -Value "User object ID $($user.Id) has no Passkey"
151
− } else {
152
− # Iterate through each Passkey method
153
− foreach ($fido in $fidos) {
154
− # Log and write to file the Passkey details
155
− Write-Host "- User object ID $($user.Id) has a Passkey with AAGUID $($fido.Aaguid) of Model type '$($fido.Model)'"
156
− Add-Content -Path $file -Value "- User object ID $($user.Id) has a Passkey with AAGUID $($fido.Aaguid) of Model type '$($fido.Model)'"
157
− }
158
− }
159
−
160
− # Log and write a separator to file
161
− Write-Host "==="
162
− Add-Content -Path $file -Value "==="
163
−}
164
−```
165120
166121
## Restrict Bluetooth usage to passkeys in Authenticator
167122
⋯ 31 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.