Skip to content

Commit a70f6cd

Browse files
authored
Merge pull request #28340 from microsoftgraph/passkey-profiles-v1-updates
Passkey profiles v1 updates
2 parents 3f8a491 + 462506b commit a70f6cd

11 files changed

Lines changed: 318 additions & 46 deletions

api-reference/v1.0/api/fido2authenticationmethod-get.md

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
---
22
title: "Get fido2AuthenticationMethod"
33
description: "Read the properties and relationships of a fido2AuthenticationMethod object."
4-
author: "calvinlui"
4+
author: "hanki71"
55
ms.reviewer: intelligentaccesspm
66
ms.localizationpriority: medium
77
ms.subservice: "entra-sign-in"
88
doc_type: "apiPageType"
9-
ms.date: 07/28/2025
9+
ms.date: 03/04/2026
1010
---
1111

1212
# Get fido2AuthenticationMethod
1313
Namespace: microsoft.graph
1414

15-
Retrieve a user's single [FIDO2 security key authentication method](../resources/fido2authenticationmethod.md) object.
15+
Retrieve a user's single [passkey (FIDO2) authentication method](../resources/fido2authenticationmethod.md) object.
1616

1717
[!INCLUDE [national-cloud-support](../../includes/global-us.md)]
1818

@@ -59,6 +59,9 @@ Don't supply a request body for this method.
5959

6060
If successful, this method returns a `200 OK` response code and the requested [fido2AuthenticationMethod](../resources/fido2authenticationmethod.md) object in the response body.
6161

62+
> [!NOTE]
63+
> This method also returns credentials key IDs formatted in Base64URL with a padding number suffix. To decode the key IDs, convert the trailing integer value of 0, 1, or 2 to the same number of base64 padding characters.
64+
6265
## Examples
6366

6467
### Request
@@ -123,13 +126,14 @@ Content-type: application/json
123126
"value": {
124127
"id": "-2_GRUg2-HYz6_1YG4YRAQ2",
125128
"displayName": "Red key",
126-
"creationDateTime": "2020-08-10T06:44:09Z",
129+
"createdDateTime": "2020-08-10T06:44:09Z",
127130
"aaGuid": "2fc0579f-8113-47ea-b116-555a8db9202a",
128131
"model": "NFC key",
129132
"attestationCertificates": [
130133
"dbe793efdf1945e2df25d93653a1e8a3268a9075"
131134
],
132-
"attestationLevel": "attested"
135+
"attestationLevel": "attested",
136+
"passkeyType": "deviceBound"
133137
}
134138
}
135139
```

api-reference/v1.0/api/fido2authenticationmethod-list.md

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
---
22
title: "List fido2AuthenticationMethod"
33
description: "Retrieve a list of the fido2AuthenticationMethod objects and their properties."
4-
author: "calvinlui"
4+
author: "hanki71"
55
ms.reviewer: intelligentaccesspm
66
ms.localizationpriority: medium
77
ms.subservice: "entra-sign-in"
88
doc_type: apiPageType
9-
ms.date: 07/28/2025
9+
ms.date: 03/04/2026
1010
---
1111

1212
# List fido2AuthenticationMethod
1313
Namespace: microsoft.graph
1414

15-
Retrieve a list of a user's [FIDO2 security key authentication method](../resources/fido2authenticationmethod.md) objects and their properties.
15+
Retrieve a list of a user's [passkey (FIDO2) authentication method](../resources/fido2authenticationmethod.md) objects and their properties.
1616

1717
[!INCLUDE [national-cloud-support](../../includes/global-us.md)]
1818

@@ -129,24 +129,26 @@ Content-type: application/json
129129
{
130130
"id": "-2_GRUg2-HYz6_1YG4YRAQ2",
131131
"displayName": "Red key",
132-
"creationDateTime": "2020-08-10T06:44:09Z",
132+
"createdDateTime": "2020-08-10T06:44:09Z",
133133
"aaGuid": "2fc0579f-8113-47ea-b116-555a8db9202a",
134134
"model": "NFC key",
135135
"attestationCertificates": [
136136
"dbe793efdf1945e2df25d93653a1e8a3268a9075"
137137
],
138-
"attestationLevel": "attested"
138+
"attestationLevel": "attested",
139+
"passkeyType": "deviceBound"
139140
},
140141
{
141142
"id": "_jpuR-TGZgk6aQCLF3BQjA2",
142143
"displayName": "Blue key",
143-
"creationDateTime": "2020-08-10T06:25:38Z",
144+
"createdDateTime": "2020-08-10T06:25:38Z",
144145
"aaGuid": "c5ef55ff-ad9a-4b9f-b580-ababafe026d0",
145146
"model": "USB key",
146147
"attestationCertificates": [
147148
"b479e7652167f574296e76bfa76731b8ccd22ed7"
148149
],
149-
"attestationLevel": "attested"
150+
"attestationLevel": "attested",
151+
"passkeyType": "deviceBound"
150152
}
151153
]
152154
}

api-reference/v1.0/api/fido2authenticationmethodconfiguration-get.md

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
---
22
title: "Get fido2AuthenticationMethodConfiguration"
33
description: "Read the properties and relationships of a fido2AuthenticationMethodConfiguration object."
4-
author: "calvinlui"
4+
author: "hanki71"
55
ms.reviewer: intelligentaccesspm
66
ms.localizationpriority: medium
77
ms.subservice: "entra-sign-in"
88
doc_type: "apiPageType"
9-
ms.date: 04/04/2024
9+
ms.date: 03/04/2026
1010
---
1111

1212
# Get fido2AuthenticationMethodConfiguration
1313
Namespace: microsoft.graph
1414

15-
Retrieve the properties and relationships of the [fido2AuthenticationMethodConfiguration](../resources/fido2authenticationmethodconfiguration.md) object, which represents the FIDO2 Security Keys [authentication method policy](../resources/authenticationmethodspolicies-overview.md) for the Microsoft Entra tenant.
15+
Retrieve the properties and relationships of the [fido2AuthenticationMethodConfiguration](../resources/fido2authenticationmethodconfiguration.md) object, which represents the passkey (FIDO2) [authentication method policy](../resources/authenticationmethodspolicies-overview.md) for the Microsoft Entra tenant.
1616

1717
[!INCLUDE [national-cloud-support](../../includes/global-us.md)]
1818

@@ -121,9 +121,26 @@ Content-type: application/json
121121
{
122122
"targetType": "group",
123123
"id": "all_users",
124-
"isRegistrationRequired": false
124+
"isRegistrationRequired": false,
125+
"allowedPasskeyProfiles": [
126+
"00000000-0000-0000-0000-000000000001"
127+
]
125128
}
126129
],
127-
"excludeTargets": []
130+
"excludeTargets": [],
131+
"passkeyProfiles": [
132+
{
133+
"id": "00000000-0000-0000-0000-000000000001",
134+
"name": "Default passkey profile",
135+
"passkeyTypes": "deviceBound,synced",
136+
"attestationEnforcement": "disabled",
137+
"keyRestrictions": {
138+
"isEnforced": false,
139+
"enforcementType": "allow",
140+
"aaGuids": [
141+
]
142+
}
143+
}
144+
]
128145
}
129146
```

api-reference/v1.0/api/fido2authenticationmethodconfiguration-update.md

Lines changed: 37 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
---
22
title: "Update fido2AuthenticationMethodConfiguration"
33
description: "Update the properties of a fido2AuthenticationMethodConfiguration object."
4-
author: "calvinlui"
4+
author: "hanki71"
55
ms.reviewer: intelligentaccesspm
66
ms.localizationpriority: medium
77
ms.subservice: "entra-sign-in"
88
doc_type: "apiPageType"
9-
ms.date: 04/04/2024
9+
ms.date: 03/04/2026
1010
---
1111

1212
# Update fido2AuthenticationMethodConfiguration
1313
Namespace: microsoft.graph
1414

15-
Update the properties of a [fido2AuthenticationMethodConfiguration](../resources/fido2authenticationmethodconfiguration.md) object, which represents the FIDO2 Security Keys authentication method policy for the Microsoft Entra tenant.
15+
Update the properties of a [fido2AuthenticationMethodConfiguration](../resources/fido2authenticationmethodconfiguration.md) object, which represents the passkey (FIDO2) authentication method policy for the Microsoft Entra tenant.
1616

1717
[!INCLUDE [national-cloud-support](../../includes/global-us.md)]
1818

@@ -69,8 +69,40 @@ Content-Type: application/json
6969
7070
{
7171
"@odata.type": "#microsoft.graph.fido2AuthenticationMethodConfiguration",
72-
"state": "enabled",
73-
"isAttestationEnforced": "true"
72+
"id": "Fido2",
73+
"state": "disabled",
74+
"isSelfServiceRegistrationAllowed": true,
75+
"isAttestationEnforced": true,
76+
"keyRestrictions": {
77+
"isEnforced": false,
78+
"enforcementType": "block",
79+
"aaGuids": []
80+
},
81+
"includeTargets": [
82+
{
83+
"targetType": "group",
84+
"id": "all_users",
85+
"isRegistrationRequired": false,
86+
"allowedPasskeyProfiles": [
87+
"00000000-0000-0000-0000-000000000001"
88+
]
89+
}
90+
],
91+
"excludeTargets": [],
92+
"passkeyProfiles": [
93+
{
94+
"id": "00000000-0000-0000-0000-000000000001",
95+
"name": "Default passkey profile",
96+
"passkeyTypes": "deviceBound,synced",
97+
"attestationEnforcement": "disabled",
98+
"keyRestrictions": {
99+
"isEnforced": false,
100+
"enforcementType": "allow",
101+
"aaGuids": [
102+
]
103+
}
104+
}
105+
]
74106
}
75107
```
76108

api-reference/v1.0/resources/enums.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -822,6 +822,30 @@ Namespace: microsoft.graph
822822
| allow |
823823
| block |
824824

825+
### attestationEnforcement values
826+
827+
| Member |
828+
|:---|
829+
| disabled |
830+
| registrationOnly |
831+
| unknownFutureValue |
832+
833+
### passkeyType values
834+
835+
| Member |
836+
|:---|
837+
| deviceBound |
838+
| synced |
839+
| unknownFutureValue |
840+
841+
### passkeyTypes values
842+
843+
| Member |
844+
|:---|
845+
| deviceBound |
846+
| synced |
847+
| unknownFutureValue |
848+
825849
### x509CertificateAuthenticationMode values
826850

827851
| Member |

api-reference/v1.0/resources/fido2authenticationmethod.md

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
---
22
title: "fido2AuthenticationMethod resource type"
3-
description: "A representation of a FIDO2 security key registered to a user. FIDO2 is a sign-in authentication method."
4-
author: "calvinlui"
3+
description: "A representation of a passkey (FIDO2) registered to a user. Passkey (FIDO2) is a sign-in authentication method."
4+
author: "hanki71"
55
ms.reviewer: intelligentaccesspm
66
ms.localizationpriority: medium
77
ms.subservice: "entra-sign-in"
88
doc_type: resourcePageType
99
toc.title: FIDO2
10-
ms.date: 07/24/2024
10+
ms.date: 03/04/2026
1111
---
1212

1313
# fido2AuthenticationMethod resource type
1414

1515
Namespace: microsoft.graph
1616

17-
A representation of a FIDO2 security key registered to a user. FIDO2 is a sign-in authentication method.
17+
A representation of a passkey (FIDO2) registered to a user. Passkey (FIDO2) is a sign-in authentication method.
1818

1919
This is a derived type that inherits from the [authenticationMethod](authenticationmethod.md) resource type.
2020

@@ -25,16 +25,18 @@ This is a derived type that inherits from the [authenticationMethod](authenticat
2525
|[Get](../api/fido2authenticationmethod-get.md)|[fido2AuthenticationMethod](../resources/fido2authenticationmethod.md)|Read the properties and relationships of a user's **fido2AuthenticationMethod** object.|
2626
|[Delete](../api/fido2authenticationmethod-delete.md)|None|Delete a user's **fido2AuthenticationMethod** object.|
2727

28+
2829
## Properties
2930
|Property|Type|Description|
3031
|:---|:---|:---|
31-
|aaGuid|String|Authenticator Attestation GUID, an identifier that indicates the type (e.g. make and model) of the authenticator.|
32-
|attestationCertificates|String collection|The attestation certificate(s) attached to this security key.|
33-
|attestationLevel|attestationLevel|The attestation level of this FIDO2 security key. The possible values are: `attested`, or `notAttested`.|
32+
|aaGuid|String|Authenticator Attestation GUID, an identifier that indicates the type (such as make and model) of the authenticator.|
33+
|attestationCertificates|String collection|The attestation certificate or certificates attached to this passkey.|
34+
|attestationLevel|attestationLevel|The attestation level of this passkey (FIDO2). The possible values are: `attested`, `notAttested`, `unknownFutureValue`.|
3435
|createdDateTime|DateTimeOffset|The timestamp when this key was registered to the user. Inherited from [authenticationMethod](../resources/authenticationmethod.md).|
3536
|displayName|String|The display name of the key as given by the user.|
3637
|id|String|The authentication method identifier.|
37-
|model|String|The manufacturer-assigned model of the FIDO2 security key.|
38+
|model|String|The manufacturer-assigned model of the FIDO2 passkey.|
39+
|passkeyType|passkeyType|The type of passkey. The possible values are: `deviceBound`, `synced`, `unknownFutureValue`.|
3840

3941
## Relationships
4042
None.
@@ -62,7 +64,8 @@ The following JSON representation shows the resource type.
6264
"createdDateTime": "String (timestamp)",
6365
"displayName": "String",
6466
"id": "String (identifier)",
65-
"model": "String"
66-
}
67+
"model": "String",
68+
"passkeyType": "String"
69+
}
6770
```
6871

api-reference/v1.0/resources/fido2authenticationmethodconfiguration.md

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
---
22
title: "fido2AuthenticationMethodConfiguration resource type"
33
description: "Represents a FIDO2 authentication methods policy."
4-
author: "calvinlui"
4+
author: "hanki71"
55
ms.reviewer: intelligentaccesspm
66
ms.localizationpriority: medium
77
ms.subservice: "entra-sign-in"
88
doc_type: resourcePageType
99
toc.title: FIDO2
10-
ms.date: 07/22/2024
10+
ms.date: 03/04/2026
1111
---
1212

1313
# fido2AuthenticationMethodConfiguration resource type
@@ -23,24 +23,26 @@ Inherits from [authenticationMethodConfiguration](../resources/authenticationmet
2323
|Method|Return type|Description|
2424
|:---|:---|:---|
2525
|[Get](../api/fido2authenticationmethodconfiguration-get.md)|[fido2AuthenticationMethodConfiguration](../resources/fido2authenticationmethodconfiguration.md)|Read the properties and relationships of a fido2AuthenticationMethodConfiguration object.|
26-
|[Update](../api/fido2authenticationmethodconfiguration-update.md)|[fido2AuthenticationMethodConfiguration](../resources/fido2authenticationmethodconfiguration.md)|Update the properties of a fido2AuthenticationMethodConfiguration object.|
26+
|[Update](../api/fido2authenticationmethodconfiguration-update.md)|None|Update the properties of a fido2AuthenticationMethodConfiguration object.|
2727
|[Delete](../api/fido2authenticationmethodconfiguration-delete.md)|None|Reverts the fido2AuthenticationMethodConfiguration object to its default configuration.|
2828

2929

3030
## Properties
3131
|Property|Type|Description|
3232
|:---|:---|:---|
33+
|defaultPasskeyProfile|String|The non-deletable baseline passkey profile, within the passkey profile collection. It's automatically created when migrating to passkey profiles and initially mirrors the tenant's legacy global passkey (FIDO2) authentication methods policy settings.|
3334
|excludeTargets|[excludeTarget](../resources/excludetarget.md) collection|Groups of users that are excluded from the policy.|
3435
|id|String|The authentication method policy identifier.|
35-
|isAttestationEnforced|Boolean|Determines whether attestation must be enforced for FIDO2 security key registration.|
36-
|isSelfServiceRegistrationAllowed|Boolean|Determines if users can register new FIDO2 security keys.|
37-
|keyRestrictions|[fido2KeyRestrictions](../resources/fido2keyrestrictions.md)|Controls whether key restrictions are enforced on FIDO2 security keys, either allowing or disallowing certain key types as defined by Authenticator Attestation GUID (AAGUID), an identifier that indicates the type (for example, make and model) of the authenticator.|
36+
|isAttestationEnforced|Boolean|Determines whether attestation must be enforced for passkey (FIDO2) registration. This property is deprecated and will be removed in October 2027. Use **passkeyProfiles** property.|
37+
|isSelfServiceRegistrationAllowed|Boolean|Determines if users can register new passkeys (FIDO2).|
38+
|keyRestrictions|[fido2KeyRestrictions](../resources/fido2keyrestrictions.md)|Controls whether key restrictions are enforced on passkeys (FIDO2), either allowing or disallowing certain key types as defined by Authenticator Attestation GUID (AAGUID), an identifier that indicates the type (for example, make and model) of the authenticator. This property is deprecated and will be removed in October 2027. Use the **passkeyProfiles** property.|
3839
|state|authenticationMethodState|The possible values are: `enabled`, `disabled`.|
3940

4041
## Relationships
4142
|Relationship|Type|Description|
4243
|:---|:---|:---|
43-
|includeTargets|[authenticationMethodTarget](../resources/authenticationmethodtarget.md) collection|A collection of groups that are enabled to use the authentication method.|
44+
|includeTargets|[passkeyAuthenticationMethodTarget](../resources/passkeyauthenticationmethodtarget.md) collection|A collection of groups that are enabled to use the authentication method.|
45+
|passkeyProfiles|[passkeyProfile](../resources/passkeyprofile.md) collection|A collection of configuration profiles that control the registration of and authentication with passkeys (FIDO2).|
4446

4547
## JSON representation
4648

@@ -57,17 +59,18 @@ The following JSON representation shows the resource type.
5759
{
5860
"@odata.type": "#microsoft.graph.fido2AuthenticationMethodConfiguration",
5961
"id": "String (identifier)",
60-
"includeTargets": [ { "@odata.type": "microsoft.graph.authenticationMethodTarget" } ],
61-
"isAttestationEnforced": "Boolean",
62-
"isSelfServiceRegistrationAllowed": "Boolean",
63-
"keyRestrictions": {
64-
"@odata.type": "microsoft.graph.fido2KeyRestrictions"
65-
},
6662
"state": "String",
63+
"defaultPasskeyProfile": "String",
6764
"excludeTargets": [
6865
{
6966
"@odata.type": "microsoft.graph.excludeTarget"
7067
}
71-
]
68+
],
69+
"isSelfServiceRegistrationAllowed": "Boolean",
70+
"isAttestationEnforced": "Boolean",
71+
"keyRestrictions": {
72+
"@odata.type": "microsoft.graph.fido2KeyRestrictions"
73+
},
74+
"includeTargets": [ { "@odata.type": "microsoft.graph.passkeyAuthenticationMethodTarget" } ]
7275
}
7376
```

0 commit comments

Comments
 (0)