Cant Read Your Security Key Please Try Again

Chapter disclaimer
This postal service contains chapter links to products mentioned in the postal service. I may receive a commission for purchases made through these links.
Nonetheless, this does not impact the quality of the content, opinions or the purpose of the mail service in any way – neither does it affect your toll should you buy the production via these links.
These links and the income they give – if the wil generate whatsoever – are a manner for me to finance running this site, without affecting the user feel for you as users in a negative way.
All posts on this page are posted based on personal experience, and I will never link to products I exercise not believe in, or personally use.
If the products are given to me for gratis, I will inform nearly this in the post – if no info is given about this – it is paid for out of my own pocket.

This mail service is non sponsored by Yubico.

About this guide

This guide will requite you a step by step guide to setup your Azure Advertising to permit FIDO2 Security keys, equally well as enabling Windows x device login using these keys.

The information in this mail is used together with Yubico's Yubikeys -and then there may be some differences should you use some other vendor.
They have various keys for diverse devices/needs. They are also working on a key with integrated fingerprint
If you are unfamiliar with Yubico security keys, you tin can accept a look over at their site or product seletion hither:

Yubico Main Website <— Affiliate link
Yubico Product Selection <— Affiliate link

About FIDO2 Security keys

Source(southward):
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless
https://fidoalliance.org/fido2/

FIDO2 security keys are an unphishable standards-based passwordless authentication method that tin can come in any form factor. Fast Identity Online (FIDO) is an open standard for passwordless authentication. FIDO allows users and organizations to leverage the standard to sign in to their resource without a username or password using an external security primal or a platform key built into a device.

For public preview, employees tin can use security keys to sign in to their Azure AD or hybrid Azure AD joined Windows 10 devices and become single-sign on to their cloud and on-premises resources. Users tin as well sign in to supported browsers. FIDO2 security keys are a great option for enterprises who are very security sensitive or have scenarios or employees who aren't willing or able to use their phone as a second factor.

Some highlights:

• FIDO2 cryptographic login credentials are unique beyond every website, never leave the user's device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft and replay attacks.
  
• Users unlock cryptographic login credentials with elementary built-in methods such every bit fingerprint readers or cameras on their devices, or by leveraging easy-to-use FIDO security keys. Consumers can select the device that best fits their needs.
  
• Considering FIDO cryptographic keys are unique for each internet site, they cannot be used to rails users across sites. Plus, biometric data, when used, never leaves the user's device.
  
• Websites can enable FIDO2 through a simple JavaScript API telephone call that is supported beyond leading browsers and platforms on billions of devices consumers apply every day.

Clarification on Passwordless authentication for Azure AD

Source:
https://docs.microsoft.com/en-united states of america/azure/active-directory/authentication/concept-hallmark-passwordless

Multi-factor hallmark (MFA) is a neat way to secure your organization, but users oft get frustrated with the boosted security layer on top of having to remember their passwords. Passwordless authentication methods are more user-friendly considering the countersign is removed and replaced with something you have, plus something you are or something you know.

The nuts of MFA

Each organisation has unlike needs when it comes to authentication. Microsoft offers the post-obit iii passwordless hallmark options that integrate with Azure Active Directory (Azure AD):

* Windows Hullo for Business
* Microsoft Authenticator App
*FIDO2 security keys

Convenience VS Security

Authenticating with FIDO2 keys to Azure Ad

The following procedure is used when a user signs in with a FIDO2 security key:

FIDO2 authentication menstruum

1. The user plugs the FIDO2 security key into their computer.
2. Windows detects the FIDO2 security central.
3. Windows sends an hallmark asking.
4. Azure Ad sends back a nonce.
5. The user completes their gesture to unlock the private cardinal stored in the FIDO2 security cardinal'due south secure enclave.
6. The FIDO2 security central signs the nonce with the individual cardinal.
7. The master refresh token (PRT) token request with signed nonce is sent to Azure Advertizing.
8. Azure Advertisement verifies the signed nonce using the FIDO2 public key.
9. Azure Advertizement returns PRT to enable admission to on-bounds resources.

Requirements

• FIDO security key(s) – Yubikeys are used in this guide
• Admin access to Azure Advertizing/Intune
• Windows 1809 or higher for just webapps usage – 1903 recommended
• Windows 10 1903 or higher – for win 10 sign in on Azure AD joined devices
• Windows x Insider Build 18945 or higher for Hybrid joined devices.
  • Azure AD Connect version i.4.32 or subsequently
  • Fully patched domain controllers (2016/2019)
• Supported browser (i.eastward Edge Chromium, Google Chrome)

Enable Security keys in Azure AD

Following, is the steps needed to enable security keys for your Azure AD tenant

Head over to you Azure Active Directory admin portal, in the portal, select "Security" in the left panel:

Azure AD overview>Security

In one case in the Security view, click on Hallmark methods in the sidebar, select FIDO2 Security central, so ready it to Enable, choose your target user(s) – can exist all, grouping or unmarried user if yous want, click save.

Authentication Methods

FIDO keys are at present enabled for web apps for your tenants, and users can enroll their security cardinal(southward).

How to enroll security key for the user

For the user enrolling the cardinal, head over to https://myprofile.microsoft.com
Once in the portal, click "Security Info", click "+ add method", cull "Security key" in the dropdown, then click "Add"

Add authentication method

If you get the prompt about needing to sign in with two-factor to do this alter, practice this every bit prompted

Sign in with 2FA prompt

After verifying with two-factor, you need to choose what kind of security key you have
Cull your device – most probable USB device

Cull security key type

Depending on your browser, you lot may get a popup as follows (This is from MS Edge Chromium)

Continue on this prompt

If this is the first time plugging in the key, yous may become a prompt to ready a PIN for your primal, or input the PIN if this is done already
In my example, the PIN is already configured, and I'g asked to input the code and touch the fundamental to go along

Click allow if y'all become this:

Allow access to see the central

The key is added, and you become prompted to put in a name for the central, This is to help y'all go on runway of your hallmark methods – this is especially useful should y'all get more security keys in time, or should you lot need to revoke the key later.

Name your key

Your key is added, and ready to be used, and should be listed under your authentication methods

Verify your central is working

To take a quick check to come across that your central is working, head over to your role 365 portal at: http://portal.office.com/

At the Sign In prompt, select "Sign-in option", so select "Sign in with a security key"

Click sign-in options

select Sign in with a security key

You volition be prompted to input your security central PIN, and touch the key for verification

If you take the key associated with multiple accounts, you will become prompted to choose the correct account, then click OK.
(Yes, you can apply the key for multiple accounts, caveat for that afterward)

Select your account – if mulitple accounts

You should now be logged in to your 365 business relationship with the selected credentials.
Notice that you did not have to input either username nor the  password for the business relationship, only the security key – great correct?

Logged on to office portal

Enabling security key sign in for Windows 10 via Intune

Now that you take your key enrolled, why non apply this key as your login to your windows ten computer also?
If you device is managed via Intune, you tin can achieve this by doing the following.

Caput over to you Microsoft Endpoint Manager admin centre here: https://devicemanagement.microsoft.com/#home

Then go to Devices, click Configuration Profiles in the middle menu, click create profile, select Windows 10 as Platform and Custom equally Profile then click Create

Create custom profile

Fix a name and description for the profile, click side by side

Name your contour and give it a clarification

In the next screen, click add together, and for the "Add Row" field input the post-obit, and click Add, then Next:

Name: Security Keys for Windows Sign-In
Description: Enables FIDO Security Keys to be used during Windows Sign In
OMA-URI: ./Device/Vendor/MSFT/PassportForWork/SecurityKey/UseSecurityKeyForSignin
Information Type: Integer
Value: ane

Create custom OMA-URI

In the Telescopic tags scrren, accept the default, click Next
In the Assignments screen, select the grouping of devices you wish to deploy this to, and so click Next

Select your targets

In the Applicability Rules, accept default, click Next
In the Review + Create screen, review your settings, and click Create

Review your settings

Your setup is now complete, when the targeted devices become the policy, you lot will take the option on the logon screen to sign-in with your security key.

FIDO cardinal available at logon screen

If the device have gotten the policy, and you insert the fundamental to the device, information technology volition inquire for your pivot directly, and so sign in – no need for username and password.

What makes this neat?

• You do not need Windows Hello to be configured to enable FIDO key sign in. This means you will get well-nigh the same convenience every bit Windows Hello Pin sign in, also on devices that does non have support for this – this will requite a better user experience.
  
• Nothing is stored in the car, all secrets etc are in the fundamental, not on the devices security chip.
  
• The user but need the primal, not the username and/or the account password. The key and PIN follows the user, across devices.
  
• In an environment with Shared devices, users tin can sign in more quickly, as they do not need to modify the user from the previous person using the machine – the central signs you in with your account details.
  
• Perfect for hot-seating and other shared workspaces/devices
  
• No countersign is stored on the device in hash format as with traditional username/password logon – ways increased security
  
• The simplicity and small fourth dimension savings here, also means better productivity, while maintaining security.
  
• The users can also use the central on other services that support the same standard – meaning a decreased assault surface from a security standpoint – ie Facebook  & Google.
  
• If y'all opt-in for a security key that also has OTP support, you lot can employ Yubico authenticator app to generate the OTP codes. This means no more MFA hassle when changing your phone for various reasons – everything is in the primal, the phone is just a tool to testify the codes.
  
• If using the keys for OTP with the authenticator app, you go yubico authenticator for mobile too as for windows, linux and mac – the will show the codes when the key is detected.
  
• The 2 options above about OTP, is great for environments where mobile devices are non allowed.
  
• If yous have 2 keys, you can register for Googles advanced protection plan, to protect your Google business relationship.
  This is a good selection to utilise for a "fill-in" email account where this is needed when registering for two factor to diverse services.
  You and then have a proberly protected backup email that has special security fastened to it.
  This is always a better option than having SMS as a fill-in method. If using a backup eastward-postal service business relationship, apply one defended to the purpose, with high security attached, and dont use this for annihilation else.

Some caveats to exist enlightened of

• If you also are using Citrix virtual apps/desktops on the devices with SSO to i.e Storefront, yous volition ned Citrix FAS to get SSO to Citrix when signing in with these keys. This is due to the SSO service for Citrix will not pass the login through when signing in with these, as there are no credentials to pass.
  The aforementioned bug goes if users are signing in with Windows Hello for Business – as both uses tokens  instead of passwords, and signing on with these will result in the normal Citrix SSO service not starting with the session.
  
• If you lot have multiple accounts on the key, and they exist in the same Azure Advertizement tenant, be careful to the order in with you lot add the cardinal to these accounts. The last account added to the primal, will exist the offset one attempted when logging in to a device.

  Where the concluding business relationship added will be the kickoff one attempted on logon – meaning accounts are added to the central bottom>Up, while hallmark is attempted superlative>downwards.
  This will mean, that in the figure below, if you add 2 users from the aforementioned tenant to the central, say nr2 and iii, the last one added (nr3) will exist the one logging on to the reckoner, as this is attempted earlier nr ii.

  This will near probable not be a regular consequence, but it is something to be aware of when adding multiple accounts from the same tenant to the same security  central.

  For sign in to Web applications, you lot wil go a list to choose from, and is not an event.

  Recollect of it like this:

Accounts on security key

Links

• Microsoft nearly passwordless: https://docs.microsoft.com/en-us/azure/agile-directory/authentication/concept-authentication-passwordless
  
• Microsoft How-to on passwordless: https://docs.microsoft.com/en-us/azure/agile-directory/authentication/howto-authentication-passwordless-deployment
  
• Microsoft on How-to enable FIDO keys: https://docs.microsoft.com/en-u.s.a./azure/active-directory/authentication/howto-authentication-passwordless-security-fundamental
  
• Microsoft on How-to enable FIDO keys for Win10: https://docs.microsoft.com/en-us/azure/active-directory/hallmark/howto-authentication-passwordless-security-key-windows
  
• Yubico: https://www.yubico.com/
  
• Yubico authenticator: https://www.yubico.com/products/services-software/download/yubico-authenticator/
  
• Yubico – downloads section: https://world wide web.yubico.com/products/services-software/download/
  
• Google'southward advanced protection program: https://landing.google.com/advancedprotection/

Original content hither is published nether these license terms:		X
License Type:	Not-commercial, Attribution, Share Akin
License Abstract:	Y'all may re-create this content, create derivative work from it, and re-publish it for not-commercial purposes, provided you include an overt attribution to the author(s) and the re-publication must itself exist under the terms of this license or similar.
License URL:	https://creativecommons.org/licenses/by-nc-sa/iii.0/

Consultant manager & SME @ iteam, localized in Kristiansund, Norway.

Focused on EUC, security, mobility, virtualization, direction and a mod workplace.
Highly specialized effectually RDS/Citrix/EUC/Mobility.

Y'all can view my profile over at Youracclaim here.

lynchberand.blogspot.com

Source: https://dybbugt.no/2020/1755/

Share this post