Question

Contoso wants to deploy passwordless authentication using FIDO2 security keys. Security policy requires that only keys from an approved hardware vendor (identified by their AAGUIDs) can be registered by users. You enable the FIDO2 security key method in the Authentication methods policy. What must you configure to enforce that only the approved vendor's keys can be registered?

Accepted Answer

Enable 'Enforce attestation' and add the approved vendor AAGUIDs to the key restriction allow list in the FIDO2 method settings

Answer

Create a Conditional Access policy requiring a compliant device before FIDO2 registration

Answer

Configure a Windows Hello for Business hybrid trust policy that references the vendor certificate

Answer

Add the vendor AAGUIDs to the Entra password protection custom banned list