passkeys-fido2

Name: passkeys-fido2
Author: vinayaklatthe

161stars34forks

How to install passkeys-fido2?

vinayaklatthe/microsoft-security-skills/passkeys-fido2

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill passkeys-fido2

Installs into the current project.

Summary

Guidance for rolling out passkeys (device-bound and synced) and FIDO2 security keys in Microsoft Entra ID as the primary phishing-resistant authentication method. Covers passkey types (device-bound in Microsoft Authenticator, synced passkeys via platform providers, hardware secur

Files · 1

View on GitHub

SKILL.md

1	# Passkeys and FIDO2 in Microsoft Entra ID
2
3	Passkeys and FIDO2 security keys are the only Entra ID authentication methods that are
4	genuinely phishing-resistant. This skill covers a pragmatic rollout: pick the right
5	passkey types for your population, bootstrap via Temporary Access Pass, enforce via
6	Conditional Access authentication strength, then retire legacy methods.
7
8	## When to use
9	Moving an Entra tenant from password+SMS/app-push toward passwordless, phishing-resistant
10	authentication. Use for method selection, registration campaigns, CA enforcement, and
11	legacy-method retirement planning.
12
13	Do not use this skill for generic CA policy authoring (`conditional-access-mfa`), full
14	Windows Hello for Business desktop design (`windows-hello`), or Verified ID credential
15	issuance (`entra-verified-id`).
16
17	## Passkey types — pick per population
18
19	\| Type \| Where it lives \| Best for \|
20	\|---\|---\|---\|
21	\| Device-bound passkey in Microsoft Authenticator \| iOS/Android app, hardware-bound, not synced \| BYOD-heavy workforces, frontline workers \|
22	\| Synced passkey (Apple iCloud Keychain, Google, Windows Hello via 1Password etc.) \| OS keychain, syncs across user's devices \| Knowledge workers with managed iOS/macOS/Windows \|
23	\| Hardware FIDO2 security key (YubiKey, Feitian, etc.) \| Removable, attested \| Privileged admins, shared workstation users, regulated roles \|
24	\| Windows Hello for Business \| Per-device, TPM-bound \| Windows workstation primary sign-in (see `windows-hello`) \|
25
26	> Rule of thumb: Default population = device-bound Authenticator passkey. Admins and
27	> tier-0 = hardware key. Mac/iPhone users where MDM/policy permits = synced passkey from
28	> the OS keychain.
29
30	## Approach
31
32	1. Enable the authentication methods. In Entra → Authentication methods, enable:
33	- Passkey (FIDO2) with explicit attestation enforcement decisions (see below).
34	- Microsoft Authenticator including passkey capability.
35	- Temporary Access Pass.
36	Scope rollout to a pilot group first.
37
38	2. Attestation policy. Decide whether to require attestation for FIDO2 registrations:
39	- Enforce attestation = Yes: only AAGUIDs (authenticator models) you allowlist can
40	register. Strong control; logistics-heavy because new device models need allowlisting.
41	- Enforce attestation = No: any FIDO2 authenticator (incl. synced passkeys from
42	platform providers) can register. Lower friction; less control.
43	For privileged populations: enforce + allowlist hardware keys. For workforce:
44	permissive.
45
46	3. Bootstrap with Temporary Access Pass. Every user needs a way to register their
47	first passkey without using a password. TAP gives a time-bound, single-use (or
48	limited-use) code:
49	- New hires: TAP issued by HR/onboarding flow.
50	- Existing users in registration campaign: TAP issued by help desk on verification.
51	- Lost-device recovery: re-issue TAP after identity proofing (consider Verified ID).
52
53	4. Registration campaign. Use the built-in registration campaign to nudge users
54	to set up Authenticator passkeys at sign-in. Run for 60–90 days; measure adoption.
55	Pair with comms: 3 emails + a Teams banner.
56
57	5. Conditional Access — authentication strength. Create a CA policy requiring
58	Phishing-resistant MFA authentication strength for:
59	- All admin roles (Global Admin, Privileged Role Admin, etc.).
60	- Privileged applications (Azure portal, Entra admin center, Exchange admin, GitHub
61	Enterprise sign-in).
62	- High-impact data apps (SAP, HR, finance).
63	Roll out per-app, not tenant-wide, to limit blast radius.
64
65	6. Retire weak methods.
66	- SMS and voice — disable as MFA methods in Authentication methods policy. They
67	remain available for SSPR only if you must.
68	- **Authenticator push wi

People who liked this also viewed

6 picks

Type

passkeys-fido2

161stars34forks

View on GitHub

How to install passkeys-fido2?

vinayaklatthe/microsoft-security-skills/passkeys-fido2

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill passkeys-fido2

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Passkeys and FIDO2 in Microsoft Entra ID
2
3	Passkeys and FIDO2 security keys are the only Entra ID authentication methods that are
4	genuinely phishing-resistant. This skill covers a pragmatic rollout: pick the right
5	passkey types for your population, bootstrap via Temporary Access Pass, enforce via
6	Conditional Access authentication strength, then retire legacy methods.
7
8	## When to use
9	Moving an Entra tenant from password+SMS/app-push toward passwordless, phishing-resistant
10	authentication. Use for method selection, registration campaigns, CA enforcement, and
11	legacy-method retirement planning.
12
13	Do not use this skill for generic CA policy authoring (`conditional-access-mfa`), full
14	Windows Hello for Business desktop design (`windows-hello`), or Verified ID credential
15	issuance (`entra-verified-id`).
16
17	## Passkey types — pick per population
18
19	\| Type \| Where it lives \| Best for \|
20	\|---\|---\|---\|
21	\| Device-bound passkey in Microsoft Authenticator \| iOS/Android app, hardware-bound, not synced \| BYOD-heavy workforces, frontline workers \|
22	\| Synced passkey (Apple iCloud Keychain, Google, Windows Hello via 1Password etc.) \| OS keychain, syncs across user's devices \| Knowledge workers with managed iOS/macOS/Windows \|
23	\| Hardware FIDO2 security key (YubiKey, Feitian, etc.) \| Removable, attested \| Privileged admins, shared workstation users, regulated roles \|
24	\| Windows Hello for Business \| Per-device, TPM-bound \| Windows workstation primary sign-in (see `windows-hello`) \|
25
26	> Rule of thumb: Default population = device-bound Authenticator passkey. Admins and
27	> tier-0 = hardware key. Mac/iPhone users where MDM/policy permits = synced passkey from
28	> the OS keychain.
29
30	## Approach
31
32	1. Enable the authentication methods. In Entra → Authentication methods, enable:
33	- Passkey (FIDO2) with explicit attestation enforcement decisions (see below).
34	- Microsoft Authenticator including passkey capability.
35	- Temporary Access Pass.
36	Scope rollout to a pilot group first.
37
38	2. Attestation policy. Decide whether to require attestation for FIDO2 registrations:
39	- Enforce attestation = Yes: only AAGUIDs (authenticator models) you allowlist can
40	register. Strong control; logistics-heavy because new device models need allowlisting.
41	- Enforce attestation = No: any FIDO2 authenticator (incl. synced passkeys from
42	platform providers) can register. Lower friction; less control.
43	For privileged populations: enforce + allowlist hardware keys. For workforce:
44	permissive.
45
46	3. Bootstrap with Temporary Access Pass. Every user needs a way to register their
47	first passkey without using a password. TAP gives a time-bound, single-use (or
48	limited-use) code:
49	- New hires: TAP issued by HR/onboarding flow.
50	- Existing users in registration campaign: TAP issued by help desk on verification.
51	- Lost-device recovery: re-issue TAP after identity proofing (consider Verified ID).
52
53	4. Registration campaign. Use the built-in registration campaign to nudge users
54	to set up Authenticator passkeys at sign-in. Run for 60–90 days; measure adoption.
55	Pair with comms: 3 emails + a Teams banner.
56
57	5. Conditional Access — authentication strength. Create a CA policy requiring
58	Phishing-resistant MFA authentication strength for:
59	- All admin roles (Global Admin, Privileged Role Admin, etc.).
60	- Privileged applications (Azure portal, Entra admin center, Exchange admin, GitHub
61	Enterprise sign-in).
62	- High-impact data apps (SAP, HR, finance).
63	Roll out per-app, not tenant-wide, to limit blast radius.
64
65	6. Retire weak methods.
66	- SMS and voice — disable as MFA methods in Authentication methods policy. They
67	remain available for SSPR only if you must.
68	- **Authenticator push wi

People who liked this also viewed

6 picks

Type