# Security key authentication method enabled
FIDO2 security keys provide hardware-backed, phishing-resistant authentication that protects against credential theft and unauthorized access.
Source: https://maester.dev/docs/tests/ZTA.21838
:::note[Maester checks this too]
[EIDSCA.AF01](/docs/tests/EIDSCA.AF01) (Authentication Method - FIDO2 security key - State.) checks the same setting. Running both reports it twice.
:::
## Overview
FIDO2 security keys provide hardware-backed, phishing-resistant authentication that protects against credential theft and unauthorized access. Security keys use cryptographic proof of identity bound to a specific device, making credentials impossible to replicate or phish. Enabling this authentication method allows users to register security keys for strong passwordless authentication.
## Remediation
- [Enable FIDO2 security key authentication method](https://learn.microsoft.com/entra/identity/authentication/how-to-enable-passkey-fido2?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-passkey-fido2-authentication-method)
- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Authentication methods |
| Area | Authentication |
| ATT&CK | [T1566.002](/docs/tests?mitre=T1566.002) Spearphishing Link |
| Licence | Free |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.