Trying to sign in with Yubikey on Win10 v1903, but the key does not appear under "sign-in options."

QDGM-SSSP 1

I went through the proper process to get this set up via Azure AD, without any problems. This worked just fine on the previous laptop (this is a replacement). The new laptop is in the correct OU and groups, too. Still, the only sign-in options I get are password and smartcard; the security key is missing.

Any ideas?

Philippe Levesque 5,681 Reputation points MVP

2019-11-05T17:25:49.357+00:00

Hi, does the smartcard need some drivers ? I would check on device manager if it's added correctly to the system when you plug in the key.
QDGM-SSSP 1 Reputation point

2019-11-05T18:15:17.02+00:00

It shows up correctly in Device Manager, yes.
FrankHu-MSFT 976 Reputation points

2019-11-06T20:19:36.747+00:00

Do you see any sign-in options like Pin or fingerprint?

And have you properly setup the sign-in option?
to set up a security key, go to Start > Settings > Accounts > Sign-in options, and select Security Key. Select Manage and follow the instructions.
QDGM-SSSP 1 Reputation point

2019-11-06T20:27:58.973+00:00

Nope, the only two options are password and smart card. I went into the sign-in options (after logging in with a password), verified that my key still worked there, then signed out. The option still does not appear on the login screen.
FrankHu-MSFT 976 Reputation points

2019-11-06T20:47:25.263+00:00

Is this machine connected to an Intune MDM?
Per the post :
https://ronnydejong.com/2019/07/12/microsoft-keeps-its-password-less-promise-and-ships-native-fido2-support-to-windows-10-azure-ad/

More official docs here : https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key

If your machine isn't managed by intune, you can use a provisioning package here:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key-windows#enable-with-a-provisioning-package
QDGM-SSSP 1 Reputation point

2019-11-06T20:49:07.553+00:00

Yes, the machine is provisioned by Intune. It's set up the same way as its predecessor, which worked fine; that's why this is so frustrating. :)
FrankHu-MSFT 976 Reputation points

2019-11-06T20:53:48.747+00:00

Also does the yubikey you're using have more than one user account on the key?
QDGM-SSSP 1 Reputation point

2019-11-06T20:54:44.953+00:00

I do not believe so.
FrankHu-MSFT 976 Reputation points

2019-11-06T20:57:04.857+00:00

I see, that's interesting. Does the yubikey option show up when you try logging in with a web browser?
QDGM-SSSP 1 Reputation point

2019-11-07T14:04:56.31+00:00

You mean under myprofile.microsoft.com, etc? Yes, it's there and configured.

2 answers

Sander Berkouwer 166 Reputation points

2019-11-10T10:54:59+00:00

It appears the device has not gotten the policy setting to show the security key option on the logon screen.
Please refresh the Intune policy on the device.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
Daniel Stefaniak 6 Reputation points

2019-11-07T18:46:13.3+00:00

to see that option your device has to be Azure AD Joined. On-prem join and Hybrid join are not supported i.e. are blocked until early 2020 https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key-windows
Please sign in to rate this answer.
QDGM-SSSP 1 Reputation point

2019-11-07T19:35:10.143+00:00

The device is already Azure AD joined, just like the last one.
Sign in to comment