If they don’t have at least one Azure Multi-Factor Authentication method registered, they must add one.If the user already has at least one Azure Multi-Factor Authentication method registered, they can immediately register a FIDO2 security key.Administrator provisioning and de-provisioning of security keys is not available in the public preview. Note that only end users can perform the enrollment.

User registration and management of FIDO2 security keys Log in to your tenant admin interface and navigate to Azure Active Directory → Security → Authentication methods.Ĭlick on 'FIDO2 Security Key' and then select 'Enable' and 'All Users'Īfter the authentication method has been activated, users are able to enroll their FIDO2 Keys. Only browsers supporting FIDO2 keys can be used as the during enrollment and sign-in A FIDO2 compatible security key, any Token2 FIDO2 Keys can be used.

A global tenant admin account in Azure AD.

An Azure AD tenant which licensed to use Azure MFA functions.

The guide below will walk you through the steps required to enable passwordless access using Token2 FIDO2 Security keys. Also note that there were changes introduced by Microsoft during the Ignite 2021 conference as described on this page. In the context of Azure AD, FIDO2 Security keys are not a replacement of the standard authentication mechanisms, they are added as an alternative, marketed by Microsoft as one of the Passwordless login methods. The access is still protected by two factors in this case: 1) having physical access to the security key and 2) PIN or Fingerprint (on devices with biometrics support) configured on the FIDO2 Security keys Once enabled, the users will be able to sign in to their accounts and log onto their Windows 10 machines (Azure AD or Hybrid AD joined ) using FIDO2 Security keys.

Passwordless authentication in Azure AD with Token2 FIDO2 keys FIDO2 based Passwordless technology allows users to use a USB key sign in to Azure AD without using passwords.

Fido key windows 10