FIDO2 as MFA token

[bart vermeersch]

Is it or will it be possible to use a FIDO2 key as an MFA token? (instead of passwordless signin)

Thanks!

[#2]

Hello, in preview https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-password...

[#3]

Sorry if my question wasn't clear enough, I know FIDO can be used for passwordless log on, but can it be used as an MFA token (instead of an authenticator app or SMS).

[#4]

Hi, perhaps some misunderstanding between us. Anyway, see this article.

https://www.rebeladmin.com/2020/03/step-step-guide-azure-ad-password-less-sign-using-fido2-security-...

[#5]

Bart, if you purchase a key such as Yubikey 5 that supports OTP, then the user can retrieve an OTP code from the device using Yubi Authenticator desktop app. That would only be needed for apps/browsers that don't support WebauthN protocol such as IE. I don't understand why you would want to get the OTP code otherwise, using passwordless auth is much simpler and more secure. It satisfies the MFA requirement, so the user doesn't get prompted for MFA when using FIDO2.

[#6]

Hi Bart

Currently there isn't a way to setup FIDO2 as MFA only. It also replaces your password

[#7]

Yeah, as noted above I had some question marks about the topic and only posted a link to the preview and a link as how to configure step-by-step. The very fundamental is the passwordless Multi-Factor Authentication itself so to speak.

Anyway, I believe this sums it up very well.

”Passwordless authentication is a form of multi-factor authentication (MFA) that replaces passwords with two or more verification factors secured and encrypted on a user’s device, such as a fingerprint, facial recognition, a device pin, or a cryptographic key.”

[#8]

@A-Zure 

>>  I don't understand why you would want to get the OTP code otherwise, using passwordless auth is much simpler and more secure.

True, but we are facing some limitations where a security key with PIN would be an easy to use MFA token:

1. In some auth flows we don't see the option to use a security key to log on. (eg If you do a Connect-AzureAD you can use a github account, but you don't get an option to sign in using a security key.)

2. We want to our users to register for MFA. Those without a smartphone would be offered a yubikey. But apparently you can't register a security key unless you register another MFA method (authenticator/phone/email) first. 

Bart

[#9]

Hi, can’t say anything about the nr 1 as it’s very brief. I’m sure you’ve checked the prerequisites. 2. Yep.

But as it’s a preview they really want to hear from you :) https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-password...

[#10]

Hello Bart, my apologies for not fully understand your question recently. Too much going on to be honest. To answer your question though... it is planned.

”Azure AD now supports FIDO2 security keys in public preview. We’re working on allowing them to be used as a second factor as well (today they are used only first in sequence, but they satisfy MFA).”

[#11]

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/passwordless-authentication-i...

(use TAP)

[#12]

@ChristianBergstrom do you know the timeline of when FIDO2 keys will be able to be used as an MFA for Windows Hello for Business?  Currently you can only use Facial recognition, fingerprint, pin, bluetooth device (e.g. cell phone), etc.  The process for enabling these is via  GPO and making sure you put in the correct code that matches the device you are using for MFA, however I can't find what that code would be for a FIDO2 key?  Multi-factor Unlock - Windows security | Microsoft Docs