Forum Discussion
Why is a PIN required for using a hardware key for MFA?
I am trying to pilot using FIDO2 hardware keys for MFA with Office 365. I see the option to add a hardware key in my Office 365 account security options. After inserting my hardware key, I get a message in Microsoft Edge that says "PIN required - Enter the PIN for your security key". This is a Yubikey, and it is not currently registered as an authentication method on my account. I don't have a PIN for it. Why am I being asked for this? I want to use this key my MFA authentication method, replacing my usual method of a mobile phone authenticator app.
4 Replies
- Microsoft has chosen to require a PIN for their implementation of FIDO2 because if someone loses the key, they don't want it to be used as single factor (something you have) and they instead want it to be multi-factor (something you know, PIN + something you have).
In your case it sounds like there was a PIN already set on that key if it is asking you for a PIN. Normally, the first time you enroll a key it will ask you to create a new PIN. So you'll need to reset that PIN. You can download a utility from the Yubico website to wipe the key so that you can establish a new PIN. https://support.yubico.com/hc/en-us/articles/360015654100-YubiKey-PIN-and-PUK-User-ManagementJoe Stocker Thank you for your reply. That's good to know, and that does answer my question.
That's unfortunate as my ideal configuration would be multi-factor with just password (something I know) and a hardware key (something I have) (so no third factor - no PIN), which is more consistent with the way most of the other services I use have implemented FIDO keys.
Thanks again for your help.
I too feel the PIN is not necessary for 2FA as the password is the first factor and the presence of the key is the second factor.
It would be nice if things could be configured this way. Perhaps I am missing something -- if so, can someone enlighten me?
I have a YubiKey 5 nano and a YubiKey 5C NFC.
