EIDSCA.AF03 - Authentication Method - FIDO2 security key - Enforce attestation.
Overview
Requires the FIDO security key metadata to be published and verified with the FIDO Alliance Metadata Service, and also pass Microsoft's additional set of validation testing.
Test script
https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Fido2')
.isAttestationEnforced -eq 'true'
Remediation action
Microsoft Learn - Enable passkeys (FIDO2) for your organization: Enforce attestation
Related links
- Open in Graph Explorer
- fido2AuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AF03 |
| Severity | High |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098.005 Device Registration |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCheckEidscaAF03 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AF03.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AF03.md