Sign in to Windows 10 with a YubiKey and Azure AD

A YubiKey is a small hardware security key that supports the FIDO2 standard. On a Windows 10 device joined to Azure Active Directory, it can replace the password at sign-in: you insert the key, enter its PIN and touch it. Because the key has to be physically present, this is both more secure and more convenient than a password.

Requirements

1. A FIDO2-compatible security key. I use a YubiKey 5.
2. Windows 10 version 1903 or later.
3. A device joined to Azure Active Directory.
4. FIDO2 security keys enabled as an authentication method in Azure AD.
5. A device policy that allows security keys for sign-in.

Step 1: register the key

Go to myprofile.microsoft.com and add the key under your security information. Set its PIN and give it a meaningful name, so you can tell your keys apart.

Step 2: check the Windows version

Get-WmiObject -Class Win32_OperatingSystem | Select BuildNumber

Version 1903 is build 18362; any higher build number is fine.

Step 3: check that the device is Azure AD joined

dsregcmd /status

AzureAdJoined should be YES.

Step 4: enable FIDO2 security keys in Azure AD

Sign in to Azure as a Global Administrator and go to Azure Active Directory → Security → Authentication methods → FIDO2 Security Key.

Set Enable to Yes and target either all users or selected users. I recommend starting with an Azure AD group. Remember to Save.

Step 5: allow security keys in Microsoft Endpoint Manager

You can enable this for every device, but a targeted profile is cleaner and better practice. In Microsoft Endpoint Manager:

1. Go to Devices → Windows → Configuration profiles → Create profile.
2. Choose platform Windows 10 and later, profile type Templates, template Identity protection, then Create.
3. Give the profile a name and a description, then Next.
4. Set Configure Windows Hello for Business to Not configured.
5. Set Use security keys for sign-in to Enable, then Next.
6. Set the scope tags as you usually do, then Next.
7. Under Assignments, add all devices or a group of devices, then Next and Create.

Force a policy sync, or wait for it, and the security key appears in the sign-in options. Insert the key, enter its PIN when asked and touch it. That’s it.