Today a short article to make people aware that a FIDO2 security key isn’t tied to one Azure AD/ Office 365 account. We don’t have to purchase a separate key for every Azure tenant we access. Fortunately, we can use a key for multiple accounts!
Some people might have access to multiple Office 365 accounts. IT staff who work for a service provider might have a long list of admin accounts with passwords to access the client’s tenants. People with a production and dev tenant (like me). To keep everything secure, for every tenant a separate password is used. That’s a hell of a job to keep these passwords separate and to remember. Passwords are often forgotten for tenants which are not accessed regularly.
When we enable security key sign-in for these tenants (even if we only do that to start with for these IT admin accounts), we can stop using all these user accounts and passwords and go passwordless.
Then it’s only a matter of inserting the FIDO key and choose the account to sign in to. No need to remember a username and password.
One caveat:
If you enroll multiple identities with a FIDO2 token, it will allow you to pick which identity to use when doing web authentication. If you take the same token and use it to log on to a Windows 10 PC, it does not give you an option of which identity to use. It will automatically use the last registered FIDO2 identity on the token.
Source
So that was a very short article 🙂
For the people who aren’t yet familiar with going passwordless with FIDO2 security keys, below is some more information regarding going passwordless. And you’ll find the steps to enable security keys in Azure AD.
FIDO2
FIDO stands for Fast Identity Online, an open standard to sign-in safely to SaaS apps and computers. The goal of FIDO is to make the sign-in process more secure and simplified. This is accomplished by sign-in without using a username and password; passwordless.
How it works in short with an example. FIDO2 makes use of a public/ private key pair for authentication. The public key is provided to the identity provider (in this case Azure AD) and the private key remains on the device (the FIDO2 security key).
When the user needs to authenticate to Azure AD (AAD) for sign-in to the Windows 10 device or sign-in to Office 365 via a browser, AAD provides the user a challenge. With the challenge, AAD wants to determine if the user is who he claims to be. The challenge is signed with the private key (which is stored on the FIDO2 key) and the result of that signature is send back to AAD. AAD can then verify the signature with your public key and allow logon.
Prerequisites
To go passwordless we have some prerequisites:
- Azure Multi-Factor Authentication
- Combined security information registration
- Compatible FIDO2 security key
- WebAuthn compatible browser like Microsoft Edge
Which browsers support WebAuthn can be found on the FIDO website.
Configure Azure for passwordless sign-in
The user needs to be enabled for multi-factor authentication. In the Azure portal, we also need to enable combined security information registration besides enabling security keys.
- Sign-in to the Azure AD portal
- Browse to Azure Active Directory – User settings
- Click Manage user feature settings
- Select All to switch on the feature for all users (or Selected for a security group)
- Click Save
- Browse to Security – Authentication methods
- Click on FIDO2 security keys
- Set Enable to Yes
- Leave Target set to All or switch to Select users and select a security group
- Click Save
That’s all to enable passwordless sign-in for Azure AD accounts.
End-user experience – configure the key
Here is an overview of how to set up and register the FIDO key.
If we have a brand new security key, it first needs to be set up. When using a Windows device, the key can be set up directly from the Settings.
Insert the key in the device and set up the key, which is pretty straightforward.
Below is a short video of the key setup in Windows.
Next, the key needs to be registered in every Azure AD account. For this, sign in to https://aka.ms/mysecurityinfo
Click Add method to add a new security key.
Choose Security key from the drop-down list and click Add.
Choose the type of the security key.
Follow the other on-screen instructions to set up the key.
When that’s finished, the key shows up under the sign-in methods.
And a short video of the registration of the key.
Repeat these registration steps for all Azure AD accounts.
End-user experience – using the key
Next time that we sign in to our AAD account, we just choose Sign-in options on the sign-in page.
Choose Sign in with Windows Hello or a security key.
Choose Security key.
Insert the key (when not already done).
Touch the key.
And select the account we want to sign in to.
And sign-in is completed, without entering a username or password!
The sign-in experience in a video.
That’s it for this post.
If you’re interested in reading more FIDO2 related posts, have a look at the FIDO2 section.
