Question

Contoso wants employees to use device-bound passkeys stored in the Microsoft Authenticator app on their corporate iOS and Android phones as a phishing-resistant sign-in method. As the Identity Administrator, you open the Authentication methods policy. Which configuration correctly enables this specific capability for a pilot group?

Accepted Answer

Enable the 'Passkey (FIDO2)' method, add the pilot group under Include, and configure the Key Restriction policy to Allow the AAGUIDs for Microsoft Authenticator.

Answer

Enable the 'Microsoft Authenticator' method and set the Authentication mode to 'Push' for the pilot group.

Answer

Enable 'Temporary Access Pass' for the pilot group so they can bootstrap the passkey during first sign-in.

Answer

Enable the 'Certificate-based authentication' method and upload the Authenticator app's device certificate to the trusted CA store.