We understand that some of our customers have questions and concerns about migrating to Azure Passwordless with FIDO2 keys. With this blog post, we aim to address and clarify some of the common queries that may arise regarding the technology.

Our goal is to help our customers make informed decisions about their authentication processes and realize the benefits of Azure Passwordless without any confusion or uncertainty.

Azure Passwordless with FIDO2 Security keys offers a robust authentication technology that allows users to log in to their accounts without using traditional passwords. FIDO2 Security keys use public-key cryptography to provide strong authentication and are protected with PIN and biometric verification. This is one of the few phishing resistant authentication methods available for Azure, and despite some myths, is one of the most secure ones.

Licensing

Azure Passwordless does not require any extra license to use it. It works with the cheapest plan, making it an affordable and accessible authentication solution for organizations of any size. Once enrolled, access to services works out of the box without any additional licenses required.

Mobile platform support

One of the primary drawbacks of using Azure Passwordless with FIDO2 Security keys is the lack of mobile platform support by Microsoft's implementation. However, this problem can be resolved by using Microsoft Authenticator as an additional authentication method. Microsoft Authenticator is a mobile app that provides two-factor authentication and passwordless sign-in to Microsoft accounts. It supports FIDO2 Security keys, so users can use their keys with the Authenticator app to sign in to Azure accounts on their mobile devices.

Configuring workstation login with FIDO2 keys

Once enrolled, users can use their FIDO2 keys to securely log in to their Windows 10/11 workstations. This may not enabled by default in the operating system settings, but it takes literally a couple of clicks for the IT support staff to enable this feature. This can be done using simple registry modification or via Intune method (requires Intune license).

Despite some minor limitations, Azure Passwordless with FIDO2 Security keys still offers significant benefits. For instance, FIDO2 Security keys provide a higher level of security compared to traditional passwords. With FIDO2 Security keys, users do not have to worry about passwords being compromised or stolen, as the keys use strong encryption to protect their data. Additionally, Azure Passwordless with FIDO2 Security keys can offer more convenience for users. They do not have to remember complex passwords or worry about resetting them every few months. Instead, they can use their FIDO2 Security keys to authenticate themselves easily and quickly. In summary, Azure Passwordless with FIDO2 Security keys is a powerful authentication technology that provides a high level of security and convenience to users. Although the lack of mobile platform support by Microsoft's implementation of FIDO2 Security keys may be a minor drawback, the benefits of this technology make it a worthwhile investment for any organization looking to improve their authentication process.

Token2 is a verified Microsoft-compatible FIDO2 security key vendor

All Token2 FIDO2 security keys listed on this page are verified by Microsoft as compatible with the Azure Active Directory passwordless experience.

Did you know?

Token2 is offering currently the most secure FIDO2 keys for enterprise customers, known as the PIN+ Series FIDO2 keys. These keys, certified by the FIDO alliance, enforce PIN complexity at the firmware level. This unique feature is not available with other keys, even those marked as FIPS-certified.

read more