Error adding Yubikey to Security Info

Question

Hi, I am following the Ms docs for going passwordless however, when I add my Security Key (add method) on the myprofile page I get the error below after naming it

We detected that this particular key type has been blocked by your organization. Contact your administrator for more details and try registering a different type of key.

Any ideas?

Answer 1

Hi, I suggest you check Authentication Methods in Azure and have a look at Key Restriction Policy -> "Enforce key restrictions" should be se to "No" unless you're limiting usage to specific keys.

What kind of Yubikey are using? If it's an older model you can try to disable "Enforce attestation" if the above doesn't help. This disables the requirement for trusted certificate usage and will allow self-signed certificate of the key itself.

Answer 2

I have add the AAGUID in Azure.

Go to authentication methods - Authentication method policy

Azure AD - Security - authentication methods.
Go to FIDO2 Security Key.

Enforce attestation
YES

And

Restrict specific keys
ALLOW

---

And for the AAGUID check this website
https://support.yubico.com/support/solutions/articles/15000028710-yubikey-hardware-fido2-aaguids