Created by Claude - please verify

FIDO2 keys and passkeys - read per user by an on-demand scan of users whose registration details list a FIDO2 method or passkey.

Required Microsoft Graph permissions

UserAuthenticationMethod.Read.All — application permission, granted to the app registration with admin consent.

Endpoints: GET /v1.0/reports/authenticationMethods/userRegistrationDetails (who has a key) · GET /v1.0/users/{id}/authentication/fido2Methods (per user)

Passkeys in Microsoft Authenticator appear as FIDO2 methods with the Authenticator model. 'Not attested' means Entra could not verify the key's make - it may be a software or synced passkey. The MFA registration cache must be loaded before you start the scan.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Security Key & Passkey Inventory

Which security keys and passkeys are in use, by make and model, and which could not be attested? You need this to answer 'are we affected?' when a key model gets a vulnerability, to enforce key restrictions (AAGUID allow list) without locking people out, and to check that admins hold phishing-resistant credentials.

Press Run scan to read the security keys and passkeys of every user who registered one.