Passwordless RDP Authentication for On-Prem Servers with Smart Cards (FIDO2 Security Key)

Hey ajf8729, I completely agree with your point. In fact, I specifically mentioned in my blog that we're using a smart card, and highlighted that some vendors provide the PIV feature in their security keys. In my case, I’m using a YubiKey which supports PIV and allows storing a certificate securely. The reason I included “FIDO2 security key” in the title was to raise awareness so that if someone is planning to buy a security key, they can also look for PIV support in case their use case requires it.

Appreciate your input!

Using "FIDO2" together with "Passwordless RDP authentication for on-prem servers" is going to bring a lot of traffic from people thinking there is a way to get FIDO2 working with Windows Server on-premises, without hybrid-join and RDS AAD authentication. There's already a lot of confusion in the industry about smartcards versus FIDO2, especially since many devices support both. You clarify it further down in the article that it's "regular" smartcards, but still use FIDO2 in the template names, etc. In fact, the article doesn't even show a path to FIDO2 support, so I wonder why it's even mentioned. A lot of IT administrators would go nuts if Microsoft suddenly supported FIDO2 truly on-premises for RDP authentication, but it's unlikely to ever happen at this point (aside from hybrid-joined systems).