Configure FIDO security keys as the default sign-in option for Windows

Today a short article on configuring FIDO2 security keys as the default login option for your Windows devices. I describe how we assign the default credential provider with Microsoft Intune, which is the logon setting to configure the FIDO Credential Provider as the credential provider.

Besides configuring the default credential provider, we can also exclude credential providers, to remove login options from the Windows logon screen. We can use this setting to block for example the usage of a password.

The combination of setting the default configuration provider to security keys and removing the password as a credential provider might come too early for default Windows end-user devices, as this also affects for example RDP and remote support (which also can’t use passwords). But for shared multi-user desktops or kiosk devices (where end-users sign in with their (Azure) AD account), these things should be less of a problem. Sign-in with a FIDO2 key to such multi-user devices is very easy for the end-user and very safe.

Credential Providers

To configure credential providers, we first need to find the corresponding GUID/ CLSID of the credential providers. The easiest manner to find the GUID we need is to check the registry of a Windows 10/11 device.
A list of registered credential providers and their GUIDs can be found in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.

All these GUIDs correspond to a credential provider. A few well-known credential providers are:

Configure the Credential Providers

We can configure the credential providers with a GPO, but I only show how it is done using Microsoft Intune. The setting is, like thousands of other settings, available in the Settings Catalog profile.

Let’s sign into the Intune portal.

• Browse to Devices, Windows, Configuration profile
• Click Create profile
• Select Windows 10 and later as Platform
• Select Settings Catalog as Profile type
• Click Create

• Enter a Name for the profile
• Enter a Description (optional)
• Click Next

• Click Add settings
• Open Administrative Templates, System, Logon
• Select Assign a default Credential provider
• Select Exclude credential providers (Optional)

On the left, the settings we selected are available to configure.

• Switch Assign a default credential provider to Enabled
• Add {F8A1793B-7873-4046-B2A7-1F318747F427} as the Default credential provider.

If you also want to exclude (remove) credential providers, add the GUIDs from the corresponding credential providers to Exclude the following credential providers.

• Switch Exclude the following credential provider to Enabled
• Add the GUIDs from the corresponding credential providers

In case you want to exclude multiple credential providers, separate the GUIDs with a comma.

Finish the creation of the profile by clicking Next and assign the profile to a security group.

The end result

After the policy settings are applied, the device first needs a restart before the settings are active.

But after the restart we immediately see on the sign-in screen, security keys are set as the default sign-in option, even as the key is not yet inserted into the device.

With a FIDO2 (bio version) security key inserted, it asks to touch the key.

When we only set the default credential provider to FIDO Credential Provider but did not exclude other credential providers, we still have to Sign-in options shown on the screen. In this case, I have the options password and smartcard also available to sign in to my kiosk device.

But after excluding these two credential providers, the Sign-in options are removed and I can only sign in to my device with a security key.

I used a biometric version FIDO2 key, which has fingerprint recognition. To sign in to my device, I insert the key and only touch the key once with my finger to get signed in to the device.

This is a very user-friendly sign-in option to use for multi-user-like devices.

if you are interested in taking the next step in going passwordless, I suggest to also read this blog post.

Thanks for reading!