Blog Post

Core Infrastructure and Security Blog
10 MIN READ

How-to: Password-less FIDO2 Security Key Sign-in to Windows 10 HAADJ Devices

LijuV's avatar
LijuV
Icon for Microsoft rankMicrosoft
Jun 03, 2020
Hello everyone, my name is Liju and I am a Premier Field Engineer specializing in Active Directory and Azure AD. Fido2 support for single sign-on (SSO) was introduced first for cloud resources, and...
Updated Jun 03, 2020
Version 5.0
LijuVarghese
PavelK_TV's avatar
PavelK_TV
Copper Contributor
Jul 04, 2024

Hi there,

 

I have a bit different case here.  We have configured environment with Azure AD joined Windows 10 (22H2) devices and enabled FIDO2 authentication. We use YubiKey and Swissbit iShield tokens with touch. Only one private key is enrolled into each token. Everything works fine as long as only one token in plugged in into the Windows machine. But, things go wrong when two ore more tokens are inserted. After the PIN for the selected account is entered login screen shows "Touch your security key to sign in". That is expected, however incorrect token might start to flashing, waiting for tapping. So, you can select an account on the left side of the screen, then enter PIN for the corresponding token and on the next step windows might ask you to tap another one, which is apparently ends up with failure. I'm not even sure whether this case is supported. Haven't found anything in the official documentation.

 

Has anyone tried this use case?