FIDO2 Authenticators

FIDO2 is an authentication standard from the FIDO Alliance. FIDO2 authenticators include on-device authenticators such as Windows Hello or Mac Touch ID, and external security keys such as a YubiKey. Passkeys are FIDO2 credentials. MFA always requires setting up an authentication profile and setting up an identity policy linked to that authentication profile. To use a FIDO2 authenticator, you must set it up in your authentication profile, your identity policy, and your user profile, in that order.

To configure tenant-level passkey settings such as user verification and attestation, see Configuring Passkeys (FIDO2).

1. In the Authentication profile you're going to use, add FIDO2 authenticator as an authentication challenge.
   Select Settings > Authentication profiles > select the profile > Edit > select FIDO2 authenticator > Save.

2. In the Identity policy linked to the authentication profile, configure the Platform to allow users to enroll passkeys.
   Select Access > Identity policies > select the policy > User security tab > Authentication settings sub-tab > Edit > Enable users to enroll passkeys > Save.

3. In your User Profile, set up your personal passkey.
   Select your user icon > Account details > Security tab > select the Passkey card > configure >  Save.