{
  "id": "CB-M365-AUTH-016",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-016",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-016.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-016.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-016",
    "title": "Restrict passkeys to approved authenticator models",
    "finding": {
      "title": "Any passkey model can be registered",
      "description": "Without key restrictions, users can register authenticators the organisation has not evaluated, including models without certification or with known weaknesses."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "passkeys",
      "fido2",
      "aaguid",
      "attestation",
      "authentication-methods"
    ],
    "description": "Every passkey profile of the **Passkey (FIDO2)** method has **Enforce attestation** set to\n**Yes** and **Enforce key restrictions** set to **Yes** with the behaviour **Allow**, limited to\nthe AAGUIDs listed in `{{ approved_aaguids }}`: the security key models and passkey providers\nthe organisation has evaluated and issues.\n\nAn AAGUID identifies the make and model of an authenticator. It is only trustworthy when\nattestation is enforced, which is why both settings go together.\n",
    "parameters": [
      {
        "name": "approved_aaguids",
        "type": "list",
        "description": "AAGUIDs of the approved security key models and passkey providers (for example a certified security key and Microsoft Authenticator for iOS and Android).",
        "default": []
      }
    ],
    "rationale": "Restricting models lets the organisation require certified hardware (FIDO certification level,\nFIPS 140, or an ANSSI qualified product), keep a known support and revocation process, and react\nquickly when a model is found vulnerable by removing its AAGUID.\n",
    "impact": "Users with a passkey from a model that is not on the list can no longer register it or sign in\nwith it, including passkeys registered before the restriction. Synced passkeys cannot be\nattested and are excluded. The organisation must buy, distribute and replace the approved keys.\n",
    "notes": "The AAGUID of a registered passkey is shown in the user's authentication method details.\nMicrosoft publishes the list of security keys eligible for attestation.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Passkey (FIDO2)** >\n   **Configure**.\n3. For each passkey profile, check **Enforce attestation** is **Yes**, **Enforce key\n   restrictions** is **Yes**, the behaviour is **Allow** and the AAGUID list matches\n   `{{ approved_aaguids }}`.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `(Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Fido2).AdditionalProperties.keyRestrictions`\n5. Fail if a profile does not enforce attestation and key restrictions, uses the **Block**\n   behaviour, or allows an AAGUID outside the approved list.\n"
    },
    "remediation": {
      "manual": "1. Inventory registered passkeys (AAGUID in each user's authentication methods) and decide the\n   approved models.\n2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n3. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Passkey (FIDO2)** >\n   **Configure** and edit each passkey profile.\n4. Set **Enforce attestation** to **Yes**, **Enforce key restrictions** to **Yes**, behaviour\n   **Allow**, and enter the approved AAGUIDs. Save.\n5. Replace users' unapproved keys before or right after the change.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Fido2`\nwith `keyRestrictions` set to `{\"isEnforced\": true, \"enforcementType\": \"allow\", \"aaGuids\": [...]}`.\n",
      "rollback": "Set **Enforce key restrictions** to **No** on the profile.\n"
    },
    "references": [
      {
        "title": "How to enable passkeys (FIDO2) in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkeys-fido2",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft Entra ID attestation for FIDO2 security key vendors",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-fido2-hardware-vendor",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-mfa",
        "framework_version": "2.0",
        "id": "R39",
        "relation": "related",
        "note": "An allow-list of attested models is how a tenant enforces the certified or qualified possession factor ANSSI asks for."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SR-11",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-015",
        "type": "requires"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}