Comment by badreligion42
4 days ago
The trap is already here for me. When I make a passkey for my corporate microsoft account, I'm only allowed to use Microsoft Authenticator on an approved device (it's not a work provided phone. Microsoft Authenticator doesn't work with rooted phones). This is not some mythical change that will happen tomorrow. It's already here for me and has made me dedicate a device, just for using passkeys for work.
Two reasons why orgs restrict the AAGUIDs down to MS Authenticator:
1. Verification of the legitimacy of the passkey. 2. Passkeys are a support nightmare if you don't restrict what can be used, and the only way to restrict is by using attestation.
If you don't restrict down, there is nothing stopping someone from setting up a passkey in Edge or Chrome or Windows Hello (not Windows Hello for business), and depending on what device or profile they are signed into, when they go onto another device, no passkey.
If someone is a single device user and only uses their corp device to access, and the corp only cares about phishing resistant MFA from an Entra perspective, as part of the auth strength configuration, Windows Hello for Business is enabled by default.