cirsec Baselines
Esc
Microsoft 365 tenant · Identity & authentication

Enable passkeys and enforce attestation for administrators

When it fails: Passkeys are not available, or administrators can register unattested passkeys. Without the Passkey (FIDO2) method enabled, nobody can register the phishing-resistant method that the administrator policy requires, and without attestation any software authenticator can pass as a security key.

CB-M365-AUTH-015highactivemanualprofile baseline

Description

In the Authentication methods policy, the Passkey (FIDO2) method is enabled for All users with Allow self-service set up set to Yes. Every passkey profile that applies to administrators (the groups or role-holders covered by CB-M365-AUTH-004) has Enforce attestation set to Yes and allows Device-bound passkeys only: FIDO2 security keys, passkeys in Microsoft Authenticator, Windows passkeys.

Profiles for other users may also allow synced passkeys (Apple, Google, third-party credential managers), which cannot be attested but remain phishing-resistant.

Users must have completed MFA in the last five minutes to register a passkey. A Temporary Access Pass (CB-M365-AUTH-017) covers the first registration.

Rationale

The phishing-resistant MFA policy for administrators can only be met if a phishing-resistant method can be registered. Attestation proves at registration that the authenticator is a genuine model from a known vendor, and is the only way to know that an administrator's passkey is device-bound and not copied to a personal cloud account.

Impact

Administrators must register a device-bound passkey: a security key, a passkey in Microsoft Authenticator or Windows Hello. Passkeys registered before attestation was enforced keep working; ask administrators to re-register them. Enabling passkey profiles is a one-way change. Since September 2026, Microsoft automatically enables passkeys for SMS and voice users with a profile that allows all passkey types; review that profile.

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Authentication methods > Policies and select Passkey (FIDO2).
  3. On Enable and target, check that the method is enabled for All users (or for every group that holds users) and note which passkey profile applies to the administrators.
  4. On Configure, check that Allow self-service set up is Yes, and that each profile applied to administrators has Enforce attestation set to Yes and Passkey types limited to Device-bound.
  5. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Fido2 | Select-Object State -ExpandProperty AdditionalProperties (passkey profiles are exposed on the beta endpoint of the same resource).
  6. Fail if the method is disabled, if self-service set up is off, or if administrators can register a passkey without attestation.

Remediation

  1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
  2. Browse to Entra ID > Authentication methods > Policies > Passkey (FIDO2) and opt in to passkey profiles from the banner if not done.
  3. On Configure, set Allow self-service set up to Yes. Select Add passkey profile, name it for example Admins - device-bound attested, set Enforce attestation to Yes and Passkey types to Device-bound, and save.
  4. On Enable and target, add the administrators group with that profile, and All users with the default profile. Save.
  5. Ask administrators to register a passkey at https://mysignins.microsoft.com/security-info. Graph equivalent: PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2 with "state": "enabled", "isSelfServiceRegistrationAllowed": true and "isAttestationEnforced": true (or the passkey profile settings on beta).

Rollback

Set Enforce attestation back to No on the administrators profile. Do not disable the method: administrators would lose their phishing-resistant method.

References

Mappings

FrameworkIDRelationNote
ANSSI - Recommandations relatives à l'authentification multifacteur et aux mots de passe2.0R2partialMakes a strong method available to everyone and attested for administrators; using it is required by CB-M365-AUTH-004 and CB-M365-AUTH-005.
NIST SP 800-53 Rev. 55.1.1IA-2(6)related
NIST SP 800-53 Rev. 55.1.1IA-5related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1557
MITRE ATT&CKT1556.006

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr