YubiShop knowledge base
Clear guidance on phishing-resistant authentication, passkeys and manageable YubiKey deployment.
Knowledge and deployment
Guides, deployment advice and technical detail for secure, phishing-resistant authentication.
Passkeys use public-key cryptography instead of a shared password. FIDO2 binds authentication to the intended service, resisting phishing on another domain. A YubiKey stores hardware-bound credentials and acts as a physical FIDO2 authenticator.
YubiKeys can serve as phishing-resistant FIDO2/passkey authenticators in Entra ID. Administrators enable the method for the relevant groups and configure registration, recovery and a phased rollout. Conditional Access should align with the tested authentication policy.
A controlled rollout starts with use cases and a pilot group, followed by registration, distribution and clear onboarding. Define lifecycle, revocation and recovery beforehand. Registering multiple phishing-resistant authenticators avoids unnecessary reliance on weaker recovery methods.
Yubico Authenticator provides access to supported YubiKey features and credential management. Depending on model and platform, it can manage FIDO2 passkeys, PINs, biometrics, OATH accounts and applications. Always check the feature matrix for the connection used.
