Make a decision between targeting All users or only selected users in the Target field.In the blade that emerges from the bottom of the Azure portal, enable the ability for people in the Azure AD tenant to use this authentication method by switching from No to Yes in the Enabled field.In the main pane, click on the FIDO2 Security Key method.In the Authentication Methods navigation menu, click on Authentication method policy (Preview).In the Security navigation menu, click on Authentication methods.In the Azure Active Directory navigation menu, click on Security.In the navigation menu, click on Azure Active Directory.Open the navigation menu, if it’s not open by default.Perform these steps to enable FIDO2 security keys as a valid authentication method in Azure Active Directory: Signing in in with the FIDO2 security keyĮnabling FIDO2 as an authentication method in Azure AD.Configuring the Windows 10 device with the right policy setting (without Intune).Configuring a security key for sign-in for the user account.Enabling FIDO2 as an authentication method in Azure AD.The Azure AD tenant the device is joined to must be configured to use the combined security information registration.Įnabling FIDO2 Security Keys as a sign-in method for Windows Hello for Business requires four steps:.You need Global administrator privileges in the Azure AD tenant that the device is joined to.This can also be achieved using Microsoft Intune, but the entire purpose is to make this work without Microsoft Intune… This can be easily achieved by assigning the Device administrator role to a person, but requires Azure AD Premium licenses. You need local administrator or System privileges on the device.The device you’re configuring needs to be Azure AD-joined.The device you’re configuring must run Windows 10 1809, or a newer version of Windows 10.

I choose the above eWBM GoldenGate FIDO2 security key of South Korean origin.

You need a compatible FIDO2 security key.

To make FIDO Key sign-in work with an Azure AD account, you’ll need to meet the following requirements: However, a method to achieve the same goal without Microsoft Intune is not part of the documentation… The official Microsoft documentation teaches us that Microsoft Intune is an optional requirement to configure Windows Hello for Business to show the option to display the FIDO security key sign-in method as part of the Sign-in options on the Windows Logon Screen for Azure AD accounts.

Microsoft fido key