Out of all the multi factor authentication options available for Azure AD, FIDO2 security keys are the one I actually trust. SMS can be intercepted through SIM swapping, authenticator app codes can be phished through a fake login page, but a FIDO2 key is bound to the exact origin it was registered against. A phishing site simply cannot get the key to respond, which is the whole point.
This walkthrough covers rolling out FIDO2 for a set of Azure AD users, using biometric hardware keys rather than a PIN, and the rollout order that avoids locking anyone out halfway through.
The Hardware I Used
I tested this with the Feitian BioPass K26 and K43 security keys. Both support fingerprint enrollment directly on the key, which is a nicer experience than typing a PIN every time you authenticate. The fingerprint data stays on the key itself and never leaves it, which matters because you never want biometric data synced to a server or shared account somewhere.
The BioPass FIDO2 Manager app makes the enrollment step quick, you plug the key in over USB, scan your fingerprint a few times until the manager confirms a good read, and the key is ready to use. No cloud account, no sign-up, it is a local operation against the key’s own secure element.
Enabling FIDO2 on the Azure AD Tenant
Before any user can register a key, the FIDO2 authentication method has to be turned on at the tenant level, under the Authentication Methods policy. This is where I’d stop and think about the rest of the authentication methods you have enabled, not just add FIDO2 on top of everything else.
Once FIDO2 is enabled, go through the other methods and turn off SMS specifically. SMS as a second factor has been considered weak for a while now because of SIM swap attacks, and keeping it enabled alongside FIDO2 just gives an attacker a downgrade path, they will always attack the weakest method available to a user’s account, not the strongest. Every user in scope should also be required to use MFA at the Conditional Access level, having FIDO2 available does nothing if MFA itself is optional.
Registering the Key on a User Account
With the tenant policy in place, each user registers their own key by signing in to myaccount.microsoft.com and going to Security Info. This is a self-service step, which matters if you are rolling this out to more than a handful of people, since IT does not need to touch each device.
The registration flow prompts for the key over USB or NFC depending on the device, asks for the fingerprint or PIN configured on the key, and then names the method so the user can tell keys apart later if they register more than one.
Always Register a Second Key
This is the step people skip and then regret. Register at least two FIDO2 keys per account, one as the daily driver and one kept somewhere safe as a fallback. If the primary key is lost, the user still has a working second factor without falling back to SMS, email recovery, or a password, all of which undo the security benefit you just added.
If both keys are somehow lost, the account recovery path should be an IT admin manually verifying identity and issuing new keys, not an automated SMS or email reset. That manual step is a minor inconvenience compared to leaving a silent bypass in the authentication flow.
Rollout Notes for a Larger Tenant
For a single account, doing this by hand takes a few minutes. For a company tenant with hundreds of users, you want the Authentication Methods policy change and any related Conditional Access updates scripted and tested in a pilot group first, then rolled out in waves. Watch for users on managed devices with restrictive USB policies, since a blocked USB port will make key registration fail in a way that looks like an Azure AD problem when it is actually a device policy issue.
Cost is a real factor too. Hardware keys are not free, and losing a key without a registered backup turns into a help desk ticket. Budget for at least two keys per user from the start rather than trying to retrofit backups after the first support ticket comes in.
Where FIDO2 Makes Less Sense
For a small team or a personal account, FIDO2 keys are close to a strict upgrade over authenticator apps, so I use them everywhere that supports it. For a large workforce with high device turnover, a mix of platform authenticators, such as Windows Hello or a phone’s built-in biometric, combined with FIDO2 for higher privilege accounts, is often more practical than issuing a physical key to every single user. Match the rollout to how much friction the group can absorb, not to what worked well for your own account.
Leave a Reply