en-US/DSInternals.Passkeys.Entra.psm1-help.xml
|
<?xml version="1.0" encoding="utf-8"?>
<helpItems schema="maml" xmlns="http://msh"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>Register-EntraPasskey</command:name> <command:verb>Register</command:verb> <command:noun>EntraPasskey</command:noun> <maml:description> <maml:para>Registers a new passkey in Microsoft Entra ID.</maml:para> </maml:description> </command:details> <maml:description> <maml:para>Registers a new passkey for the specified user in Microsoft Entra ID.</maml:para> <maml:para>When called without the -Passkey parameter, this cmdlet performs the full registration flow: it requests a challenge from Entra ID, drives the local authenticator (which prompts the system passkey UI), and submits the attestation to complete enrollment. When called with -Passkey, it submits a previously produced attestation, which is useful when the credential ceremony was run separately (e.g. via New-Passkey in a pipeline).</maml:para> <maml:para>Requires an active Microsoft Graph connection (Connect-MgGraph) with the UserAuthMethod-Passkey.ReadWrite.All scope (least privileged) or UserAuthenticationMethod.ReadWrite.All. Registering a passkey on behalf of another user additionally requires the Authentication Administrator or Privileged Authentication Administrator role.</maml:para> <maml:para>The server-issued challenge has a fixed validity of 5 minutes, which cannot be changed.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>Register-EntraPasskey</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>DisplayName</maml:name> <maml:description> <maml:para>Custom name given to the registered passkey.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="User"> <maml:name>UserId</maml:name> <maml:description> <maml:para>The unique identifier of the user. Either the object id (GUID) or UPN.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>Register-EntraPasskey</maml:name> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>DisplayName</maml:name> <maml:description> <maml:para>Custom name given to the registered passkey.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="Attestation"> <maml:name>Passkey</maml:name> <maml:description> <maml:para>The attestation credential produced by the local WebAuthn authenticator (e.g. via New-Passkey). Wrapped into a Microsoft Graph attestation response before being submitted.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">AttestationPublicKeyCredential</command:parameterValue> <dev:type> <maml:name>AttestationPublicKeyCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="User"> <maml:name>UserId</maml:name> <maml:description> <maml:para>The unique identifier of the user. Either the object id (GUID) or UPN.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none"> <maml:name>DisplayName</maml:name> <maml:description> <maml:para>Custom name given to the registered passkey.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="named" aliases="Attestation"> <maml:name>Passkey</maml:name> <maml:description> <maml:para>The attestation credential produced by the local WebAuthn authenticator (e.g. via New-Passkey). Wrapped into a Microsoft Graph attestation response before being submitted.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">AttestationPublicKeyCredential</command:parameterValue> <dev:type> <maml:name>AttestationPublicKeyCredential</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="User"> <maml:name>UserId</maml:name> <maml:description> <maml:para>The unique identifier of the user. Either the object id (GUID) or UPN.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes /> <command:returnValues> <command:returnValue> <dev:type> <maml:name>Microsoft.Graph.PowerShell.Models.MicrosoftGraphFido2AuthenticationMethod</maml:name> </dev:type> <maml:description> <maml:para></maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para>The FIDO2 authentication method policy in Microsoft Entra ID must have the "Allow self-service setup" option enabled. This is a documented limitation of the underlying Microsoft Graph API.</maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------------------- EXAMPLE 1 --------------------------</maml:title> <dev:code>Connect-MgGraph -Scopes 'UserAuthMethod-Passkey.ReadWrite.All' Register-EntraPasskey -UserId 'AdeleV@contoso.com' -DisplayName 'YubiKey 5 Nano'</dev:code> <dev:remarks> <maml:para>Performs the full registration ceremony in one step: fetches creation options, prompts the local authenticator, and submits the attestation to Entra ID with the given display name.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------------------------- EXAMPLE 2 --------------------------</maml:title> <dev:code>Connect-MgGraph -Scopes 'UserAuthMethod-Passkey.ReadWrite.All' Invoke-MgCreationUserAuthenticationFido2MethodOption -UserId 'AdeleV@contoso.com' | New-Passkey | Register-EntraPasskey -UserId 'AdeleV@contoso.com' -DisplayName 'YubiKey 5 Nano'</dev:code> <dev:remarks> <maml:para>Splits the registration into explicit pipeline stages: fetch options, create the credential locally, and submit the attestation. Equivalent to the single-step form but lets the caller inspect intermediate values.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Online Version:</maml:linkText> <maml:uri>https://github.com/MichaelGrafnetter/webauthn-interop/tree/main/Documentation/PowerShell/Register-EntraPasskey.md</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>New-Passkey</maml:linkText> <maml:uri></maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Create fido2AuthenticationMethod</maml:linkText> <maml:uri>https://learn.microsoft.com/en-us/graph/api/authentication-post-fido2methods</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> </helpItems> |