Set FIDO2 minimum pin length in a hybrid environment

[woelki]

Hi there,

we have just established a successful pilot for FIDO2 security key usage with WHfB in a hybrid environment. The key which has been registered in Azure is able to authenticate the user on all cloud apps and at the Windows 10 login screen.

For Windows Hello for business we have used the Intune policy which requires a minimum PIN length of six signs (still default), but for our FIDO2 security key it is possible to generate a 4 digit PIN. So it seems the WHfB policy does only affect the Windows 10 client, not the FIDO2 key.

Is it possible to enforce a policy which improves the security key requirements?

Kind regards,
woelki

[#2]

Hi, we are also interested in any answers to this question.
Regards,
James.

[#3]

Also interested in the answer to this question for Azure AD passwordless security keys

[#4]

Oh and it would be nice to find out support for stuff like this too, these are regulatory requirements for some:
-Have no repeating digits (i.e., 112233)
-Prevent sequential patterns (i.e., 123456)
-Prevent PIN to match the Userid.
-Expiration
-Prevent new PIN from matching the previous (X) number of PINs

[#5]

I can tell you something about what I have found ou in the meantime. I had a chat with some 3rd party manufacturers and it looks like the minimum PIN lenght or complexity depends on the FIDO sticks themselves. Unfortunately you cannot manage this with Microsoft builtin management tools.

In most cases the standard FIDO sticks from all manufacturers are not able to do this, but the more expensive sticks with FIPS industry standard will let you change your PIN requirements.

[#6]

Can you be more specific?
Please name some examples of FIDO sticks that let you change PIN requirements and what is the process to actually change the PIN requirements?
So, are you saying even these "more expensive sticks" don't have any kind of complex PIN requirement (blocking PINs like 1234 etc.) enabled out of the box by default?