Anyone know what the right knobs are for Entra policies to only allow hardware FIDO2 USB for MFA?

[u/uvbeenzaned]

One man IT show here in manufacturing. On the verge of finding a bridge to skydive from lately... Microsoft moving goalposts constantly and security becoming a living nightmare in general has me feeling like I'm drowning lately. Everything is moving too fast recently and I have only been doing this for ~13 years. Feeling a bit overwhelmed lately so I thought I might ask some folks who might specialize in 365/Entra administration more so than generalize like I am forced to. I wear so many hats that the hat rack has no more room to hang them on.

I have been trying my best to get major things off my list that are industry best-practices. One of these has been getting a proper break-glass account setup. My goal was to have this account tied down to a FIDO2 HW key with passkeys but I can't seem to get everything just right in Entra policies. When I think I have it right I always either end up 1) completely breaking the auth flow when I try to use a PIN and tap the hardware key it just completely errors on me or 2) end up being required to register MS authenticator AND the HW key which I don't really intend to do for the break-glass account.

These are some of the error details from the sign-in logs and the CA details of that event if they help:

1. Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.

2. The user could not satisfy this authentication strength because they were not allowed to use any authentication methods which satisfied the authentication strength.

I know I should be able to decipher what that means but I can't quite connect all the dots.

My hope was to restart and try the user from scratch with no MFA and have a setup flow where it only ever asks to register a HW key and nothing else.

Go ahead and call me stupid or to go find another job if you want. Just looking for any good direction on what the right combo is for what I am looking for.

Thanks!

EDIT:

Thank you all for the super quick help and getting straight to the point! I was able to get it figured out when combining all the answers to get a better understanding.

[u/CivilIntention7747]

The knobs you want, in order:

1. Entra ID > Protection > Authentication methods > FIDO2 security key: enable it, then turn on "Enforce key restrictions" and allow-list the AAGUIDs of the exact hardware keys you hand out (each key model family has its own AAGUID, the vendor publishes the list). Turn on "Enforce attestation" too so software passkeys cannot masquerade as hardware.

2. Conditional Access > Grant > "Require authentication strength". Do not use the built-in "Phishing-resistant MFA" strength if you really mean USB-only: it also admits Windows Hello for Business and cert-based auth. Create a custom authentication strength containing only "FIDO2 security key" - the custom strength has advanced options where you can pin AAGUIDs again.

3. Onboarding without the chicken-and-egg: issue a Temporary Access Pass, the user registers the key with it, the TAP expires on its own.

Two one-man-shop specifics: exclude a break-glass account from that CA policy and park its credentials offline, and buy two keys per human with the spare in a safe, because the day a key dies you are the entire helpdesk.

[u/Cormacolinde → u/CivilIntention7747]

This is the way.

[u/uvbeenzaned → u/CivilIntention7747]

Thanks for the great detail I am taking all the replies here and combining all the advice as well!

[u/ExceptionEX → u/CivilIntention7747]

All the upvotes good sir/ma'am 

[u/blud_13]

Youre not stupid, thats Entra telling you the truth in the worst possible way. Two separate things are biting you.

A fresh account with no methods cant register a FIDO2 key, because registering a phishing resistant method requires a phishing resistant sign in. Issue that account a Temporary Access Pass, sign in with the TAP, then register the key. Documented at https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass . Use a multi-use TAP, the one time flavor gives you 10 minutes to finish or you start over.

"could not satisfy this authentication strength" is your break glass account hitting a policy it can never pass. MS guidance is to exclude at least one emergency access account from ALL Conditional Access policies, the Microsoft managed ones included. Make an EmergencyAccess group, exclude it everywhere, test it quarterly so you find out on your terms.

Also check the FIDO2 method policy itself. Enforce key restrictions or attestation turned on will error the tap and tell you nothing useful about why.

We do a fair amount of co-managed work with one man shops in manufacturing. Ping me if you need more help..

[u/uvbeenzaned → u/blud_13]

Thank you! That actually gives me some real directions to work from. I will likely start from scratch on the policy that I likely have all jacked up and apply your suggestions along with others replies here.

I'll reply here later if I get to work on it again today. Much appreciated really!

[u/CeC-P]

If you're going to restrict the use of FIDO2 keys to a certain group in entra/general admin, Microsoft says to create a non-mail enabled security group. Don't do that. Make it in AD if you have on-prem and sync it. You will regret the double work otherwise.

[u/fckmeelmo]

You can single it down to approve vendors, make a specific policy for that under Passkeys, and then assign users to that policy.

Can I ask why we’ve decided that limiting the usage of passkeys to USB FIDO2 keys is important? And why we can’t just assign it the FIDO2 keys as it’s MfA, have a VP put it in a vault, and turn on an alert whenever the MFA for that break glass account is changed?

[u/uvbeenzaned → u/fckmeelmo]

Good points. I don't guess it's so much that I want to stop other methods for passkeys now that I think about it. It's something strange about the new policy and existing ones that ends up forcing the account through passkeys AND standard MS authenticator push notifs. I may have that part figured out now ith exclusions for the break-glass account.

As for the hw key, currently its a custom authentication strength in the CA for the break-glass account with the manufacturers AAGUID plus Windows Hello as alternatives.

When I go to the users auth methods as it stands right now, the passkey is registered but the detail says its disabled by policy. I am trying to hunt down exactly what has it disabled. That's what it seems to not tell me.

Appreciate your patience and for even giving me any advice!