Enabled Fido2 for all users, but this MFA option does not show under authentication types ...

Will try - this might be it - key has to be registered per User first apparently. The Entra settings already match yours. Will report back soon.

Hello @Mike Schumann,

Thank you for your quick response. Please refer and verify it once on per user base and I just wanted to know if by any chance are you trying to setup Passkey in Microsoft Authenticator app (Preview)? If yes, please let me know.

Looking forward for your response. Have a great day!

Thanks,
Raja Pothuraju.

Agreed!

Sorry - no cigar. It does work in principle, but not the way I need to use it. For me - already using a phone number + Authenticator - it works by registering the Fido2 key in my security settings. Then I was able to add them to my MFA methods.

The user group I want to use the Fido2 method for is overseas - and they do not have a company phone - apparently you cannot add or register a Fido2 key to an account without that??? - that was the whole idea - using MFA for people that do not have a company cell phone.

Hello @Mike Schumann,

Thank you for sharing your results.

Based on what you have shared, I see you have conducted two tests: one with your user account, where you have already registered with a phone number and Microsoft Authenticator, and another with a new user who has not registered with any authentication methods.

When you tried to add/register a FIDO Security Key with your account, you were able to do so. However, when you attempted the same with the new user account, you found that the option to add the Security Key as an authentication method was not available.

This second scenario with the new user is expected. You cannot add or register a FIDO2 Security Key to an account without having at least one multi-factor authentication method in place. Please refer to the screenshot below.

I understand that due to this limitation, you were unable to add a FIDO2 Security Key to your new user's group, as they do not have company cell phones. However, we do have a workaround for these scenarios by adding a Temporary Access Pass (TAP) to those users. Please follow the documentation below to create a Temporary Access Pass for users:

Create a Temporary Access Pass

After creating a TAP for users, ask them to log in to https://aka.ms/mysecurityinfo with their Username and TAP code. They will then be able to add a FIDO2 Security Key as a sign-in method.

I found a public document that clearly details each step, along with screenshots of the end-user experience during this registration process. You can refer to the document below:

End-user experience

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.