What Is Fido2

FIDO2 is an open authentication standard designed to improve identity security through passwordless sign-in methods.

Passkeys replace traditional passwords with cryptographic credentials, making authentication both more secure and easier to use.

FIDO2 helps protect against phishing and credential theft by keeping private authentication keys on a user's device.

Users can authenticate with FIDO2 using methods such as biometrics, security keys, mobile devices, or PINs.

Organizations are increasingly adopting FIDO2 as part of modern identity and access management strategies to reduce password-related security risks.

What are passkeys and how do they relate to FIDO2?

How does FIDO2 authentication work?

Types of FIDO2 authenticators

Roaming (or cross-platform) authenticators

Platform (or bound) authenticators

How to register and sign in to FIDO2-supported services:

Step 1: When registering with a service, you’ll be prompted to choose a supported FIDO authenticator method.

Step 2: Activate the FIDO authenticator with a simple gesture that the authenticator supports, whether entering a PIN, touching a fingerprint reader, or inserting a FIDO2 security key.

Step 3: Once the authenticator is activated, your device will generate a private and public key pair that is unique to your device, account, and the service.

Step 4: Your local device securely stores the private key and any confidential information pertaining to the authentication method, such as your biometrics data. The public key is encrypted and, along with a randomly generated credential ID, registered with the service and stored on its authenticator server.

Step 1: The service issues a cryptographic challenge to confirm your presence.

Step 2: When prompted, perform the same authenticator gesture used during account registration. Once you have confirmed your presence with the gesture, your device will then use the private key stored locally on your device to sign the challenge.

Step 3: Your device sends the signed challenge back to the service, which verifies it with the securely registered public key.

Step 4: Once finished, you’re logged in.

What are the benefits of FIDO2 authentication?

Enhances user privacy

Simplifies access management

What are WebAuthn and CTAP2?

What are FIDO U2F and FIDO UAF?

How to implement FIDO2

Implementing the FIDO2 standard on websites and apps requires your organization to have modern hardware and software. Fortunately, all leading web platforms, including Microsoft Windows, Apple iOS and MacOS, and Android systems, and all major web browsers, including Microsoft Edge, Google Chrome, Apple Safari, and Mozilla Firefox, support FIDO2. Your identity and access management (IAM) solution must also support FIDO2 authentication.

In general, implementing FIDO2 authentication in new or existing websites and apps entails these key steps:

Define the user login experience and authentication methods, and set access control policies.

Create new or modify existing registration and sign-in pages with the appropriate FIDO protocol specifications.

Set up a FIDO server to authenticate FIDO registration and authentication requests. The FIDO server can be a standalone server, integrate with a web or application server, or provided as an IAM module.

Build new or modify existing authentication workflows.

FIDO2 and biometric authentication

Biometric authentication uses a person’s unique biological or behavioral characteristics to confirm that the individual is who they claim to be. Biometric data is collected and converted into biometric templates that are only accessible with a secret algorithm. When the individual attempts to sign in, the system recaptures the information, converts it, and compares it with the stored biometric. Examples of biometric authentication include the following: Biological

Biometrics authentication is a reality in today’s hybrid, digital workplaces. Employees like the fact that it gives them flexibility to quickly and securely authenticate wherever they choose. Businesses like that it significantly reduces their attack surface, discouraging cybercrimes that might otherwise target their data and systems. Yet biometric authentication is not entirely hacker proof. For example, bad actors can use someone else’s biometric data, such as a photo or silicone fingerprint, to impersonate that individual. Or they can combine multiple fingerprint scans to create a primary scan that gives them access to several user accounts. Other downsides to biometric authentication exist. Some facial recognition systems, for example, have an inherent bias against women and people of color. In addition, some organizations choose to store biometric data on database servers rather than on end-user devices, raising questions security and privacy. Still, multifactor biometric authentication remains one of the most secure methods available today to verify user identities.

Examples of FIDO2 authentication

Banking, financial services, and insurance

Aviation and airlines

Create peace-of-mind security with FIDO2

Frequently asked questions

FIDO2 stands for (Fast IDentity Online 2), the latest open authentication standard released by the FIDO Alliance. Comprising Microsoft and other technology, commercial, and government organizations, the alliance seeks to eliminate the use of passwords over the World Wide Web. FIDO2 specifications includes Web Authentication (WebAuthn), a web API that allows online services to communicate with FIDO2 platform authenticators (such as fingerprint and facial recognition technologies embedded in web browsers and platforms). Developed by the World Wide Web Consortium (W3C) in partnership with the FIDO Alliance, WebAuthn is a formal W3C standard. FIDO2 also includes the Client-to-Authenticator Protocol 2 (CTAP2), developed by the alliance. CTAP2 connects roaming authenticators (such as external FIDO2 security keys and mobile devices) to FIDO2 client devices through USB, BLE, or NFC.

FIDO2 is an open, license-free standard for multifactor passwordless authentication in mobile and desktop environments. FIDO2 works by using public key cryptography instead of passwords to validate user identities, thwarting cybercriminals who attempt to steal user credentials through phishing, malware, and other password-based attacks.

The benefits of FIDO2 authentication include greater security and privacy, user-friendly experiences, and improved scalability. FIDO2 also simplifies access control for IT teams and help-desk staff by reducing workloads and costs associated with managing usernames and passwords.

A FIDO2 key, also called a FIDO2 security key, is a physical hardware device required for two-factor and multifactor authentication. Acting as a roaming FIDO authenticator, it uses USB, NFC, or Bluetooth to connect to a FIDO2 client device, allowing users to authenticate on multiple computers, whether in the office, at , or in another setting. The client device verifies the user’s identity by asking the user to use the FIDO2 key to make a gesture, such as touching a fingerprint reader, pressing a button, or entering a PIN. FIDO2 keys include plug-in keys, smartphones, tablets, wearables, and other devices.

Organizations deploy FIDO2 authentication methods based on their unique security, logistical, and industry requirements. For example, banks and research-driven manufacturers often require office-based and other employees to use company-provided, for-business-use-only desktops and laptops with platform authenticators. Organizations with people on the go, such as airline crews and emergency response teams, instead often access shared tablets or workstations and then authenticate using security keys or authenticator apps on their smartphones.

Follow Microsoft Security