Azure AD returns PRT to enable access to on-premises resources.

Azure AD verifies the signed nonce using the FIDO2 public key.

The primary refresh token (PRT) token request with signed nonce is sent to Azure AD.

The FIDO2 security key signs the nonce with the private key.

The user completes their gesture to unlock the private key stored in the FIDO2 security key’s secure enclave.

Windows sends an authentication request.

Windows detects the FIDO2 security key.

The user plugs the FIDO2 security key into their computer.

Let’s see the process going when a user signs in with a FIDO2 security key: (Read the full version at ) If you are interested in any of our ATKeys’ technical details, please feel free to contact us. Based on FIDO2 standard, the private key or any fingerprints info would never leave in the security key, or can it be copied or accessed from the device. Our series of security keys include ATKey.Pro and ATKey.Card are fingerprint-based FIDO2 biometric keys. Windows Hello for Business is available for employees using dedicated computers The FIDO2 security key can be used for both employees who use a dedicated computer and those who may use shared PCs in their workplace.ĪuthenTrend is a member of both the FIDO Alliance and the Microsoft Intelligent Security Association (MISA). Microsoft’s passwordless authentication currently supports Windows Hello for Business and FIDO2 security keys.

The preview delivers users with a fast, easy, passwordless and secure way to access Windows devices and all Azure-connected apps and services. Microsoft announced a public preview of Hybrid Azure AD support for FIDO2-based passwordless sign-in. Welcome to join the passwordless secure authentication environment.

Windows 10 fido key