mirror of
https://github.com/KelvinTegelaar/CIPP.git
synced 2026-04-25 00:06:06 +03:00
[GH-ISSUE #5189] [Feature Request]: Deploy authentication policies with approved AAGUID lists #2491
Labels
No labels
API
Feature
NotABug
NotABug
Planned
Sponsor Priority
Sponsor Priority
bug
documentation
duplicate
enhancement
needs more info
no-activity
no-priority
not-assigned
pull-request
react-conversion
react-conversion
roadmap
security
stale
unconfirmed-by-user
unconfirmed-by-user
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/CIPP#2491
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @dszp on GitHub (Jan 12, 2026).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/5189
Please confirm:
Problem Statement
Microsoft now supports syncable Passkeys (FIDO2) and allows you to create an allowlist of AAGUIDs that define which password managers (or hardware keys) can authenticate, usually to include Microsoft Authenticator. Adding all desired AAGUIDs to the list is time consuming to do manually since there are a large number of AAGUIDs if you want to allow a lot of Yubikey models, for example (since each set of capabilities requires a new AAGUID).
Various resources are available for finding AAGUID definitions from manufacturers and password manager vendors, such as:
And others that are web-searchable. Additionally, being able to choose whether to allow attestation or not (it's required to NOT require attestation to allow syncable passkeys currently) would be useful, in addition to controlling authentication types required or disallowed by policy.
Benefits for MSPs
Being able to deploy a list of AAGUIDs that include Authenticator, Yubikey models, and for example 1Password as a password manager would be a huge benefit to being able to deploy standards quickly, along with defining attestation being required or not, and would help with allowing users using MSP approved/provided/supported password managers to save Passkeys for login and provide more options than just Authenticator for phishing-resistant MFA (just available finally in Nov. 2025 from Microsoft) would be a big win in driving better MFA adoption.
Value or Importance
Syncable passkey support has been desired for a long time and is finally here as of Nov. 2025, but it's important to centrally deploy/manage in order to make it usable, since syncable passkeys are not enabled by default on Microsoft tenants, and properly securing (requiring a known password manager, for example) syncable passkeys is an important but currently complex task that requires reading and following complex documentation and copying/pasting many AAGUIDs per tenant/policy, so it's a valuable add to add central management that exists nowhere else yet that I know of.
PowerShell Commands (Optional)
No response
@github-actions[bot] commented on GitHub (Jan 22, 2026):
This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.
@TargetCrafter commented on GitHub (Jan 26, 2026):
I would love to see this feature implemented too!
@Nathanymous commented on GitHub (Jan 26, 2026):
This would be awesome and very helpful if implemented!
@github-actions[bot] commented on GitHub (Feb 5, 2026):
This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.
@swissbuechi commented on GitHub (Feb 5, 2026):
Please also add an option to configure the other options available like
Enforce attestationwhile you're at it.This needs to be disabled if you want to allow synced Passkeys via Bitwarden etc.
Thank you guys <3
@github-actions[bot] commented on GitHub (Feb 15, 2026):
This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.
@swissbuechi commented on GitHub (Feb 15, 2026):
Not stale
@KelvinTegelaar commented on GitHub (Feb 15, 2026):
Please do not bump feature requests, if it times out, you can resubmit after 30 days.
@mruiterhype commented on GitHub (Feb 19, 2026):
Would love to see this implemented, especially with Microsoft starting to auto‑enable passkey profiles in March: https://lazyadmin.nl/office-365/auto-enabled-passkey-profiles-in-march-2026/
@github-actions[bot] commented on GitHub (Mar 1, 2026):
This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself.