{
  "id": "CB-M365-AUTH-015",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-015",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-015.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-015.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-015",
    "title": "Enable passkeys and enforce attestation for administrators",
    "finding": {
      "title": "Passkeys are not available, or administrators can register unattested passkeys",
      "description": "Without the Passkey (FIDO2) method enabled, nobody can register the phishing-resistant method that the administrator policy requires, and without attestation any software authenticator can pass as a security key."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "passkeys",
      "fido2",
      "phishing-resistant",
      "attestation",
      "authentication-methods"
    ],
    "description": "In the Authentication methods policy, the **Passkey (FIDO2)** method is enabled for **All\nusers** with **Allow self-service set up** set to **Yes**. Every passkey profile that applies to\nadministrators (the groups or role-holders covered by CB-M365-AUTH-004) has **Enforce\nattestation** set to **Yes** and allows **Device-bound** passkeys only: FIDO2 security keys,\npasskeys in Microsoft Authenticator, Windows passkeys.\n\nProfiles for other users may also allow synced passkeys (Apple, Google, third-party\ncredential managers), which cannot be attested but remain phishing-resistant.\n",
    "rationale": "The phishing-resistant MFA policy for administrators can only be met if a phishing-resistant\nmethod can be registered. Attestation proves at registration that the authenticator is a\ngenuine model from a known vendor, and is the only way to know that an administrator's passkey\nis device-bound and not copied to a personal cloud account.\n",
    "impact": "Administrators must register a device-bound passkey: a security key, a passkey in Microsoft\nAuthenticator or Windows Hello. Passkeys registered before attestation was enforced keep\nworking; ask administrators to re-register them. Enabling passkey profiles is a one-way\nchange. Since September 2026, Microsoft automatically enables passkeys for SMS and voice users\nwith a profile that allows all passkey types; review that profile.\n",
    "notes": "Users must have completed MFA in the last five minutes to register a passkey. A Temporary\nAccess Pass (CB-M365-AUTH-017) covers the first registration.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** and select **Passkey\n   (FIDO2)**.\n3. On **Enable and target**, check that the method is enabled for **All users** (or for every\n   group that holds users) and note which passkey profile applies to the administrators.\n4. On **Configure**, check that **Allow self-service set up** is **Yes**, and that each\n   profile applied to administrators has **Enforce attestation** set to **Yes** and\n   **Passkey types** limited to **Device-bound**.\n5. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Fido2 | Select-Object State -ExpandProperty AdditionalProperties`\n   (passkey profiles are exposed on the beta endpoint of the same resource).\n6. Fail if the method is disabled, if self-service set up is off, or if administrators can\n   register a passkey without attestation.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Passkey (FIDO2)**\n   and opt in to passkey profiles from the banner if not done.\n3. On **Configure**, set **Allow self-service set up** to **Yes**. Select **Add passkey\n   profile**, name it for example `Admins - device-bound attested`, set **Enforce\n   attestation** to **Yes** and **Passkey types** to **Device-bound**, and save.\n4. On **Enable and target**, add the administrators group with that profile, and **All\n   users** with the default profile. Save.\n5. Ask administrators to register a passkey at https://mysignins.microsoft.com/security-info.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2`\nwith `\"state\": \"enabled\"`, `\"isSelfServiceRegistrationAllowed\": true` and\n`\"isAttestationEnforced\": true` (or the passkey profile settings on beta).\n",
      "rollback": "Set **Enforce attestation** back to **No** on the administrators profile. Do not disable the\nmethod: administrators would lose their phishing-resistant method.\n"
    },
    "references": [
      {
        "title": "How to enable passkeys (FIDO2) in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Passkeys (FIDO2) authentication method in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passkeys-fido2",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-mfa",
        "framework_version": "2.0",
        "id": "R2",
        "relation": "partial",
        "note": "Makes a strong method available to everyone and attested for administrators; using it is required by CB-M365-AUTH-004 and CB-M365-AUTH-005."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(6)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1557"
      },
      {
        "framework": "mitre-attack",
        "id": "T1556.006"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-004",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-005",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-016",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-017",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}