YubiKeys for Microsoft Azure AD Passwordless Sign In Guide

Introduction

Microsoft allows organizations to enable FIDO2 Security Keys as a passwordless authentication factor. By utilizing Microsoft Passwordless Login flows, organizations may realize the following benefits:

• Strong security - improved protection against phishing, man-in-the-middle, and password spray attacks
• Improved user experience - end users no longer have to deal with long, complex, and rotating passwords
• Reduced costs - minimize password-related help desk tickets that account for a large percentage of IT help desk resources.

Microsoft’s Passwordless sign-in with YubiKeys applies to the following scenarios:

1. Azure Active Directory web applications
2. Azure Active Directory joined Windows 10/11 devices (Windows 10 1909 and later)
3. Hybrid Azure Active Directory joined Windows 10/11 devices (Windows 10 2004 and later)

The chart below indicates where the YubiKey works with Azure AD Passwordless (FIDO2). This assumes the current versions of operating systems and browsers.

For more details on Azure AD Passwordless support please see Microsoft's documentation here Browser support of FIDO2 passwordless authentication.

The documents attached below serve as a guide for organizations looking to configure and deploy Microsoft’s Passwordless Sign-in for Azure AD. More information about the Microsoft + Yubico partnership can be found here.

Getting Additional Help

For more information, and to get help with your YubiKeys, see the following guides (updated June 2023):

• Support home page
• Open a Support ticket