EIDSCA.AF06 - Authentication Method - FIDO2 security key - Restrict specific keys.
Overview
Defines whether the configured AAGUID list is used to allow or block registration.
You should use Block or Allow as value to allow- or blocklisting of AAGuids.
Test script
https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations('Fido2')
.keyRestrictions.aaGuids.Count -gt 0 -and $result.keyRestrictions.aaGuids -notcontains $null -and $result.keyRestrictions.aaGuids -notcontains '' -and ($result.keyRestrictions.enforcementType -eq 'allow' -or $result.keyRestrictions.enforcementType -eq 'block') -eq 'true'
Remediation action
Microsoft Learn - Enable passkeys (FIDO2) for your organization: Restrict specific keys
Related links
- Open in Graph Explorer
- fido2AuthenticationMethodConfiguration resource type - Microsoft Graph v1.0 | Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AF06 |
| Severity | Medium |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098.005 Device Registration |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCheckEidscaAF06 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AF06.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AF06.md