Configure the Passkey (FIDO2 WebAuthn) authenticator groups

Create groups of Okta-recognized Passkey (FIDO2 WebAuthn) authenticators and use them in policies. This simplifies the task of requiring your users to authenticate with specific Passkey (FIDO2 WebAuthn) authenticators when you create policies.

  1. In the Admin Console, go to Security > Authenticators.

  2. On the Setup tab, click Actions in the Passkey (FIDO2 WebAuthn) row, and then select Authenticator groups.
  3. To add an authenticator group, click Add group.
  4. Enter the group name and add Passkey (FIDO2 WebAuthn) authenticators to the group.
  5. Optional. Select Match on AAGUID alone to let users enroll some authenticators in the group that don't provide an attestation certificate. See Match authenticators on AAGUID alone.
  6. Click Add group.

To edit or delete an authenticator group, find it in the Authenticator groups list, and then click Actions. Click Edit or Delete.

Before you can delete an authenticator group, you must remove it from all authentication enrollment policies that include it. See Edit an authenticator enrollment policy.

Match authenticators on AAGUID alone

Early Access release. See Enable self-service features.

By default, when an authenticator enrollment policy uses an authenticator group, users can only enroll an authenticator from that group if the authenticator provides a valid attestation certificate. Some authenticators don't always provide an attestation certificate when users enroll them. Users can't enroll these authenticators even when their AAGUID is in the group.

To let users enroll these authenticators, select Match on AAGUID alone when you add or edit the group. Users can then enroll an authenticator from the group without an attestation certificate in the following scenarios:

  • The authenticator signs the attestation with its own key, and its FIDO Metadata Service (MDS) entry lists basic_surrogate as an attestation type.
  • The authenticator doesn't send attestation data, and its FIDO MDS entry identifies it only as a platform authenticator (with an attachment hint of internal).

Before you use this option, turn on the Match AAGUID groups on AAGUID alone for FIDO2 (WebAuthn) Authenticators feature.

Note the following:

  • Without a certificate, Okta can't verify that the authenticator is the model that its AAGUID identifies.
  • If an authenticator enrollment policy uses more than one authenticator group, users can enroll an authenticator without a certificate when any of those authenticator groups includes its AAGUID and has this option selected.
  • An authenticator that provides an attestation certificate that fails validation is still rejected.
  • You can't select this option when Certificate-based attestation validation is enabled for the Passkey (FIDO2 WebAuthn) authenticator.
  • If an app sign-in policy rule requires hardware protection, users can't use these authenticators to meet that requirement.