New Hires, Lost Keys & Lessons Learned

This post details the technical controls and configuration steps for rolling out FIDO2 hardware authenticators (YubiKeys) within an Azure AD environment. It covers enabling FIDO2, enforcing AAGUIDs and key attestation policies for security, enabling Azure AD Multi-Factor Authentication, configuring Authentication Strengths to restrict allowed methods (FIDO2, WHFB, TAP), and outlines the use of Conditional Access Policies (CAPs) to enforce these configurations. It also touches on edge cases like new hire onboarding using Temporary Access Pass (TAP) codes and handling lost or broken authenticators via rollback groups or multi-use TAP codes.