Technical Controls, Rollout, & Edge Cases

This post details the technical controls and configuration steps for rolling out FIDO2 hardware authenticators (YubiKeys) within an Azure AD environment. It covers enabling FIDO2, enforcing AAGUIDs and key attestation policies for security, enabling Azure AD Multi-Factor Authentication, configuring Authentication Strengths to restrict allowed methods (FIDO2, WHFB, TAP), and outlines the use of Conditional Access Policies (CAPs) to enforce these configurations. It also touches on edge cases like passwordless authentication via Microsoft Authenticator for mobile devices.