Auditing FIDO2 authentication for Windows Sign-in
This document explains how to audit FIDO2 security-key sign-ins on Windows by correlating Entra ID key identifiers with Windows WebAuthN/CTAP event logs (especially Event IDs 1103, 2225, and 1104) to track each key use, PIN attempts, and the user who successfully authenticated.
