Since the last article, many vendors are producing FIDO2 compliant security keys, but Microsoft requires vendors to be on an approved list for Azure AD to accept the key during enrollment. That's problematic if you bought keys from the "wrong" vendor.

Tim Steiner from OnlyKey.io helped figure out how to whitelist a FIDO2 compliant key for your own tenant.

You can add specific unsupported vendor security keys to your Azure AD (or restrict to a specific list):

To discover the AAGUID of your key, use the Python-fido2 tool from Yubico: python-fido2 on GitHub (https://github.com/Yubico/python-fido2)

Example AAGUID for OnlyKey: 79D699DF01914B10B9035467E7CE8231

More info: Ensurity ThinC-AUTH (https://www.ensurity.com/Products/ThinC_AUTH)

Very small FIDO2 devices with biometric and button versions. Requires AAGUID whitelisting for Azure AD but works out of the box with Windows Hello.

More info: KEY-ID Security Keys (https://www.key-id.com/fido-security-keys-overview/)

A completely different kind of security key, made by whitehat hackers and security experts. Open source like the Solokey.

Not recommended for average users due to complex enrollment, but perfect for sysadmins and security-focused geeks.

More info: OnlyKey (https://onlykey.io/)

As organizations adopt passwordless, remember to encourage users to use their keys for both business and personal accounts. This drives adoption and awareness. And let them keep the key - don't make a fuss about tracking and returning keys. They should be considered expendable.