Windows 10: How do I use the Yubikey Security key FIDO2 for passwordless secure logon to Windows?

Hello, I have purchased a Yubikey Security key to increase the security of my private microsoft account. Although I managed to register the key, but no computer offers me the possibility to log in with this key.I would like to switch to the passwordless login you so promote, but this problem prevents me from doing so.Is there something I need to set or enable somewhere, or is the key not usable for a private account?

:)

 

Windows 11 22H2 - FIDO2 Security Key logon not working

Hi -

I am currently aware of the issues with FIDO2 security logon after updating to Windows 11 22H2.

My machine is currently running build 22621.819 (just updated with KB5019980 this morning).

Even after reinstalling windows, I am unable to logon with my FIDO2 security key. I am able to enter my PIN... the key does not recognize my touch input. If I raise my laptop lid slightly after touching the key, I am able to log on. Firmware, etc on my computer and dock are up to date. This issue only began affecting me after my machine updated to 22H2 on 10.5.2022. I am able to log on with my password. I am able to use my security key when prompted via WebAuth.

I have also tried forcing an install of the remediation update (KB5017389), but my computer tells me it is not able to/not applicable on my machine.

Please advise...

 

When I register my yubo yubikey on my windows laptop don't I have to use the yubikey on my computer.

Hi, Howard_35_78

Welcome to the MicroSoft Community.



Yes, you must first register your YubiKey with your Outlook.com account, irrespective of whether you are using a local or an administrator account on your computer. Here’s how you can set it up:

1. Enable Two-Step Verification:
   
   • Log into your Outlook.com account.
     
   • Go to ‘Security Settings’ and enable ‘Two-step Verification’.
     
2. Add YubiKey as a Security Key:
   
   • In the ‘Security Basics’ page, click on ‘More Security Options’.
     
   • Under the ‘Windows Hello and Security Keys’ section, click on ‘Set up a Security key’.
     
   • Follow the prompts to add your YubiKey as a security key.
     

After these steps, you can use your YubiKey to authenticate yourself when logging into your Outlook.com account from any computer. When you insert your YubiKey into a USB port and touch the button on the YubiKey, it generates a one-time password to authenticate your login. This means that you don’t have to remember a password, making your account more secure against phishing and other attacks.

The YubiKey 5C NFC works with both local and administrator accounts and can be used to secure a wide range of online services that support FIDO U2F or FIDO2 protocols, including Microsoft accounts. Remember, it’s always recommended to have a backup login method (like a secondary email, phone number, or another security key) in case you lose your YubiKey.



If there is anything not clear or I can't understand your problem, please do not hesitate to let me know.



Best Regards

Martin | Microsoft Community Support Specialist

 

Discovered after trying to sign-into MS that the FIDO2 key was removed

a FIDO2 security key is one option of Passwordless login. Attached is a screenshot showing the advanced security options after I had re-added the same key.

It's unclear whether the Passwordless account setting should now show as being turned ON after I re-added the key and I'm unable to recall if the Passwordless account setting ever used to be turned ON before this mysterious disappearance of the FIDO2 key - - - Updated - - -

After clicking on the link to the ArgonSystems web page posted by commenter - Louis on Super User, a section titled under "User registration of FIDO security keys" is referring to a user first needing to register a security key and add it as an authentication method in their security information page in Azure. I don't recall this being a required step when originally setting up the key in early 2019. Sorry, I'm somewhat confused as to needing to register using the Azure MFA method