Cannot opt for Passkey method from user side.

Question

Hi,

I've created conditional access policy to enforce passkey authentication and at the time of login test user I can see the below popup

but when i tried to proceed further in order to assign Yubikey, below error occors

Please check and let me know how I can resolve this issue.

Answer 1

Since you can not accept your own fix as the answer, I have added here. If you desire, please mark this as the answer so others can benefit. thank you.

FYI, passkey enrollment is possible at the time of logging-in the problem was with the AAGUID, I was needed to add AAGUID based on the Yubikey model on Authentication Strengths and then, I didn't see any error while enrolling key from user's side.

Thank You

Answer 2

What does this CA policy look like?

Did you meet all the pre reqs?

Is attestation enabled?

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2

Answer 3

Hi @Andy David - MVP Below is CA policy which I've created for test and yes Enforce attestation is enabled.

Still not able to passkey from the user side while login but at the same side user is able to to enroll for passkey via https://mysignins.microsoft.com/security-info

Answer 4

Hello @Vaibhav Srivastava Admin,

Thank you for reaching out to Microsoft Q&A. 

We understand that you are experiencing the below error when you are trying to register Passkeys: "Passkey not registered. We were unable to register the passkey you attempted to add. Please Try again." 

Hope the suggestions by @Andy David - MVP worked for you.

In addition to that could you please change Enforce Attestation = No and check if you are able to register the passkeys. 

There are few other scenarios where this error may occur: If the used provider is not Microsoft Authenticator or Windows hello as Microsoft Entra ID currently supports device-bound passkeys stored on FIDO2 security keys and in Microsoft Authenticator.

Hope this helps. Do let us know if you any further queries.

Thanks & Best Regards

Janaki Kota

Answer 5

Thats by design!

You have to enroll passkeys via the security info menu, not when logging on to Azure resources.

Thats why users should already have a MFA method enrolled, then they can add a passwordless/phish resistant method after that.

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-register-passkey-with-security-key#first-time-registration