Windows hello for business enrollment not working on FIDO keys

Have an issue where I can't get the enrollment for WHFB to work unless users log in with a password.

We are a hybrid environment - AD and Entra joined. TAP is not an option as you have to be entra only.

We have Yubikeys setup to work as an alternate login source which is linked with ENTRA ID. This works and users can sign in using these keys. The goal is passwordless with WHFB.

However when logging in using the Yubikeys - it will never prompt for registration to WHFB. I have to log out and log in with a password in order for that to happen.....

Has anyone got that to work?

That's way above my paygrade and I don't understand a word of it but welcome to the forum. Hopefully one of the ones that work in IT can help you.

This is by design. It prevents an attacker from gaining access to a system with a single factor and then registering their own key. Hence you need to use a different factor such as password, pin, smart card to register

neemobeer said:

This is by design. It prevents an attacker from gaining access to a system with a single factor and then registering their own key. Hence you need to use a different factor such as password, pin, smart card to register

Click to expand...

Yup. It ain't 2fa if you only need one method of entry.