Entra AD FIDO2 Integration

Pre-conditions

To End users must be in possession of a Keyek Card and have been onboarded with a KeyekID.

Keyek Integration Instructions

Entra AD Setup

1. Sign into your Azure portal as an administrator.

2. Browse to Microsoft ID Entra > Security > Authentication methods > FIDO2 Security Key (Preview).

3. Under the method FIDO2 Security Key, set the following options and save the configuration:

   1. Enable - Yes or No

   2. Target - All users or Select users

   3. Enforce attestation – set to No

Entra Azure AD setup screen

Prepare End User Devices

Setting up User Devices

End user devices require the latest Microsoft operating system and Keyek Companion Service. If the device you are preparing does not have Bluetooth, please install the USB BT adaptor provided with the Keyek Card when completing end user set-up.

Update all Devices to 20H2 (minimum)

Serenity Companion Service

Run the Serenity Companion installer package which will set the service to run in the background, enabling the Keyek Card to securely communicate with Keyek via the PC’s Bluetooth connection. You can find the installer at Downloads section.

Connecting and Activating Keyek Card

The following sections can be completed by end users; however, certain tasks, such as setting a PIN, must be done by the end user only. Users can refer to the Keyek Card User Guide for assistance. For more information on this, refer to Set your PIN section.

Before a Keyek Card can be used for authentication, it must be paired with a PC. Pairing the Keyek Card follows the same procedure as pairing any other Bluetooth device and requires passcode confirmation for added security.

Activation is the process by which Keyek links the device to the Keyek Platform, ensures its security status, and allows the end user to set their secret PIN.

When you first power on your Keyek Card, it will display the message Ready for Activation below the Keyek Card number.

Pairing a Keyek Card with the PC

1. Go to Windows Settings > Bluetooth.

2. Turn on your Keyek Card.

3. Click Add Device and the first option Bluetooth to initiate a search for available Bluetooth devices.

4. In the results view look for a 16-digit number in the list e.g., 1002000000009643 and click on the device name with your mouse (see Add a Device Screen).

5. The screen on both devices will now display a compare passcodes and confirm message. Click Connect on the PC and touch the green “tick” on the Keyek Card.

Add a device screen and Keyek Card compare passcode confirmation screen

Activating a Keyek Card

Until it is activated your Keyek Card will display the message “Ready for Activation” below the Keyek Card number. Once Serenity Companion is installed and your Keyek Card paired, the PC will connect to the paired device whenever they are in range and switched on. This is indicated on the Keyek Card by the Bluetooth icon (indicates Bluetooth connection is present) and the “V” icon showing connection to Keyek.

1. Confirm the Keyek Card is connected correctly by viewing the BT and V icons.

2. Navigate to the Activate command by pressing 0-5-3.

3. The Keyek Card will display Activating. Follow the prompts on the Keyek Card to complete the process and create and confirm your PIN.

4. Once successfully activated the Keyek Card will display Ready to Vero .

To activate a Keyek Card you must be connected to Keyek. If you do not see the “V” icon, check your internet connection. For more information on setting a secure PIN, refer to Set your PIN section.

Register your Keyek Card to your “Sign in” Account

This final setting requires the end user to login to their Microsoft account online and add the Keyek Card as a security device to their profile.

1. End users need to browse to https://mysignins.microsoft.com and sign-in (if not already) with their Windows username and password.

2. Click Security info.

3. To add a FIDO2 Security key, click Add method. The Add a method screen opens up.

4. From the Which method would you like to add menu, choose Security key and click Add. The Security key window opens up.

4. Click on Choose the type of security key that you have menu. From the drop-down choose USB device.

5. Make sure your Keyek Card is turned on and ready and choose Next. The browser will connect with and register the device against your account.

6. The user will be returned to the combined registration experience and asked to provide a meaningful name for the key so the user can identify each if they have multiple. Click Next.

7. Click Done to complete the process.

Login to your Device

1. Power up, log out of your device or return to the lock screen (WIN+L).

2. On the screen select Sign-in Options or if already displayed click the FIDO security key icon, and the message will change to request you to Turn on your Bluetooth security key or insert it into the USB port.

3. Turn on your Keyek Card and once connected it will display available accounts.

4. Select your account.

   1. If multiple accounts exist, select account using up/down (8/0).

   2. Click the green tick to select.

   3. Enter your PIN on the Keyek Card when prompted.