Configuring Passkeys (FIDO2)
This feature is currently available only to customers participating in a Private Preview. If you'd like to participate and be among the first to try this feature, ask our support or account team for details.
Passkeys (FIDO2) let users authenticate using biometrics, device PINs, or hardware security keys instead of, or alongside, passwords. This topic describes how to configure passkey authentication settings for your tenant.
This topic covers tenant-level provider settings. To enable FIDO2 in authentication profiles and identity policies, see FIDO2 Authenticators.
Before You Begin
Verify the following before starting:
- You have the Platform Admin role. This role is required to edit Multi-Factor Authentication (MFA) provider settings.
- You know which authenticator types your organization supports: platform, cross-platform, or both.
- You have decided whether to allow cloud-synced passkeys, such as iCloud Keychain or Google Password Manager.
Accessing Passkey Settings
- Navigate to Settings > MFA and security > MFA providers.
- Select the Passkeys (FIDO2) tab.
The passkey settings are preconfigured with default values. These default values were selected to balance security and usability.
Settings Reference
The following table summarizes all passkey settings.
| Setting | Options | Editable |
|---|---|---|
| Relying party ID | Set at provisioning | No |
| Relying party name | Free text | Yes |
| Allowed origins | Set at provisioning | No |
| Max credentials | 1–10 | Yes |
| User verification | Required / Preferred / Discouraged | Yes |
| Resident key | Required / Preferred / Discouraged | Yes |
| Allow syncable credentials | Checked / Unchecked | Yes |
| Authenticator attachment | Any / Platform / Cross-platform | Yes |
| Attestation | None / Indirect / Direct / Enterprise | Yes |
Editing Passkey Settings
- Click Edit in the top right of the page. This unlocks the entire page, including both Relying party identity and Authentication requirements. You cannot edit the two sections independently.
- Update the settings described in the sections below.
- Click Save to apply your changes, Reset to revert to the default configuration, or Cancel to exit without saving.
Relying Party Identity Settings
- Relying party ID: The domain associated with your tenant, for example
yourcompany.delinea.app. Passkeys are cryptographically bound to this domain and stop working if it changes. This value is set during provisioning and cannot be edited. - Relying party name: Your organization's name, saved with each new passkey. Applies to new enrollments only; many browsers and platforms display the relying party ID instead.
- Allowed origins: The web addresses permitted to complete passkey authentication. Fixed to match your tenant's domain and cannot be edited.
- Max credentials: The number of passkeys a single user can register at once. The range is 1 to 10.
Authentication Requirements Settings
User Verification
Controls whether the authenticator must confirm the user's identity, via biometric or PIN, before completing login.
- Required: The user must verify every time.
- Preferred: Verification happens if the authenticator supports it, but is not enforced.
- Discouraged: Skips verification where possible.
Resident Key
Controls whether the passkey is stored on the authenticator itself. Stored (discoverable) credentials enable usernameless login, so the user can authenticate without typing a username first.
- Required: Forces discoverable credentials.
- Preferred: Uses discoverable credentials if the authenticator supports them.
- Discouraged: Avoids storing credentials on the authenticator.
Allow Syncable Credentials
Controls whether cloud-synced passkeys, such as iCloud Keychain or Google Password Manager, are accepted.
- Checked: Cloud-synced passkeys are allowed.
- Unchecked: Blocks cloud-synced passkeys specifically.
Hardware security keys are unaffected by this setting.
Authenticator Attachment
Restricts which type of authenticator can be used.
- Any: Allows both platform authenticators (built into the device) and cross-platform authenticators (external keys).
- Platform: Allows only authenticators built into the device.
- Cross-platform: Allows only external hardware keys.
Attestation
Controls how much proof is required about the authenticator's make and model during registration.
- None: No attestation is checked.
- Indirect: Attestation is requested but may be anonymized or routed through a privacy certificate authority (CA).
- Direct: Attestation is requested directly from the authenticator.
- Enterprise: Attestation includes additional identifying information, intended for managed enterprise deployments.
Changing Settings After Passkeys Are Registered
If you tighten these settings after users have registered passkeys, existing credentials are not re-validated or removed. Existing registrations remain untouched. For example:
- Lowering Max credentials, for example from 5 to 2, does not remove existing registrations above the new limit. It only restricts new registrations going forward.
- Changing Attestation, for example from None to Direct, applies to new registrations only. Passkeys enrolled under the previous policy remain valid and are not re-checked.
User verification is the exception. Setting User verification to Required applies to all existing credentials immediately, not just new ones. Any user whose security key has no PIN, or whose device has no fingerprint, face unlock, or PIN set up, may be locked out at their next sign-in. Verify your users' credentials and confirm an admin recovery path before you save this change.
Troubleshooting
Issue: A user cannot register a passkey
Cause: The authenticator type or attestation data does not match the configured requirements.
Solution:
- Check Authenticator attachment. If set to Platform or Cross-platform, the user's authenticator type may not match.
- Check Attestation. If set to Direct or Enterprise, an authenticator without the required attestation data fails registration.
Issue: A user cannot register a synced passkey
Cause: Cloud-synced passkeys are blocked by the provider configuration.
Solution:
- Check whether Allow syncable credentials is unchecked.
- If unchecked, only hardware security keys function. Cloud-synced passkeys are blocked regardless of device.
Issue: A user hit their passkey limit and cannot register a new one
Symptom: Registration fails. The response contains "has reached the maximum of <n> registered credentials".
Cause: The user has reached the configured Max credentials limit.
Solution:
- Check the Max credentials value.
- Ask the user to remove an existing passkey before registering a new one.
Issue: A user still has more passkeys than a newly lowered Max credentials limit
Cause: This is expected behavior, not a bug. Existing registrations are not removed retroactively.
Solution: No action available or required. The new limit applies only to future registrations.
Issue: Attestation was changed to a stricter value
Cause: Existing passkeys remain valid under the policy they were registered under.
Solution: No action available or required. Only new registrations are checked against the updated Attestation requirement.
Issue: Relying party ID or Allowed origins cannot be edited
Cause: These values are tied to your tenant's domain and set during provisioning. Passkeys are cryptographically bound to them, so changing them would invalidate existing credentials.
Solution: No action available or required. This screen simply explains why some fields are pre-populated and cannot be updated.
