List FIDO2 Keys and AAGUID for all Users with Microsoft Graph
Hi All,
While looking into Enable passkeys in Microsoft Authenticator (preview) i figured, it is a good Idea tho have a List of FIDO2 AAGUID’s of all Users if enabled.
This Article shows you how to Export the FIDO2 Keys and the AAGUID of all Users in a M365 Tenant.
During my research i also found some AAGUID Lists on the Internet
Here you can see a registered FIDO2 Key in the M365 Security Info
Let’s get that Information with PowerShell and the Microsoft.Graph PowerShell
Connect with Microsoft Graph
Connect-MgGraph -Scopes User.Read.All, UserAuthenticationMethod.Read.All -NoWelcome
You need to be Global Admin to Grant Admin consent
Let’s list the FIDO2 Key of the User we have seen in the first Screenshot. You can see the AAGUID, Creation Time, Model and AsstetationLevel.
Get-MgUserAuthenticationFido2Method -UserId a.bohren@serveralive.onmicrosoft.com | fl
But we need to get that for all Users, so we need all Users
$EntraUsers = Get-MgUser -All
$EntraUsersCount = $EntraUsers.Count
Write-Host "Users found: $EntraUsersCount"
Loop through the Users ad add the FIDO2 Keys to a PSCustom Object and finally to a List
#Create ListObject
$FIDO2List = [System.Collections.Generic.List[object]]::new()
#Loop through Users
$INT = 0
Foreach ($EntraUser in $EntraUsers)
{
$INT = $INT + 1
$UPN = $entraUser.UserPrincipalName
Write-Host "Working on: $UPN [$INT/$EntraUsersCount]" -ForegroundColor Green
$Fido2Methods = Get-MgUserAuthenticationFido2Method -UserId $UPN
#If FidoMethods found
If ($Null -ne $Fido2Methods)
{
Write-Host "FIDO2 found" -ForegroundColor Cyan
Foreach ($Fido2Method in $Fido2Methods)
{
$FIDOObject = [PSCustomObject]@{
UserPrincipalName = $UPN
AAGUID = $Fido2Method.AAGUID
Model = $Fido2Method.Model
AttestationLevel = $Fido2Method.AttestationLevel
}
#Add to ListObject
$FIDO2List.Add($FIDOObject)
}
}
}
Show the List Object
#Show Fido Authentication Methods
$FIDO2List
And export it to a CSV
#Export to CSV
$FIDO2List | Export-CSV -Path C:\Temp\Fido2List.csv -Encoding UTF8 -NoTypeInformation
And this is the CSV Export
The Script has also been published to my GitHub Repo
Regards
Andres Bohren