Description
Every passkey profile of the Passkey (FIDO2) method has Enforce attestation set to
Yes and Enforce key restrictions set to Yes with the behaviour Allow, limited to
the AAGUIDs listed in {{ approved_aaguids }}: the security key models and passkey providers
the organisation has evaluated and issues.
An AAGUID identifies the make and model of an authenticator. It is only trustworthy when attestation is enforced, which is why both settings go together.
The AAGUID of a registered passkey is shown in the user's authentication method details. Microsoft publishes the list of security keys eligible for attestation.
Rationale
Restricting models lets the organisation require certified hardware (FIDO certification level, FIPS 140, or an ANSSI qualified product), keep a known support and revocation process, and react quickly when a model is found vulnerable by removing its AAGUID.
Impact
Users with a passkey from a model that is not on the list can no longer register it or sign in with it, including passkeys registered before the restriction. Synced passkeys cannot be attested and are excluded. The organisation must buy, distribute and replace the approved keys.
Parameters
| Parameter | Baseline | Hardened | Bounds |
|---|---|---|---|
approved_aaguidslist. AAGUIDs of the approved security key models and passkey providers (for example a certified security key and Microsoft Authenticator for iOS and Android). | | |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
- Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
- Browse to Entra ID > Authentication methods > Policies > Passkey (FIDO2) > Configure.
- For each passkey profile, check Enforce attestation is Yes, Enforce key
restrictions is Yes, the behaviour is Allow and the AAGUID list matches
{{ approved_aaguids }}. - Read-only alternative with Microsoft Graph PowerShell (scope
Policy.Read.All):(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Fido2).AdditionalProperties.keyRestrictions - Fail if a profile does not enforce attestation and key restrictions, uses the Block behaviour, or allows an AAGUID outside the approved list.
Remediation
- Inventory registered passkeys (AAGUID in each user's authentication methods) and decide the approved models.
- Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
- Browse to Entra ID > Authentication methods > Policies > Passkey (FIDO2) > Configure and edit each passkey profile.
- Set Enforce attestation to Yes, Enforce key restrictions to Yes, behaviour Allow, and enter the approved AAGUIDs. Save.
- Replace users' unapproved keys before or right after the change.
Graph equivalent:
PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2withkeyRestrictionsset to{"isEnforced": true, "enforcementType": "allow", "aaGuids": [...]}.
Rollback
Set Enforce key restrictions to No on the profile.
References
- How to enable passkeys (FIDO2) in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
- Microsoft Entra ID attestation for FIDO2 security key vendors Microsoft, vendor-doc, accessed 2026-10-24
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI - Recommandations relatives à l'authentification multifacteur et aux mots de passe2.0 | R39 | related | An allow-list of attested models is how a tenant enforces the certified or qualified possession factor ANSSI asks for. |
| NIST SP 800-53 Rev. 55.1.1 | IA-5 | related | |
| NIST SP 800-53 Rev. 55.1.1 | SR-11 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Related controls
- requires
CB-M365-AUTH-015Enable passkeys and enforce attestation for administrators
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
