VeriMark™ Guard Setup Guide
Kensington takes pride in making our comprehensive
installation guides easy to follow with simple illustrations andstep-by-step instructions. This guide will walk you throughsetup and help you get to know your VeriMark™ Guard.

Enabling Support for Fido2 Security Keys  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 2Documentation & References   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 4

Fido2 Security Key Provisioning and Key Management  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 5Documentation & References   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 10Configuring Windows 10 Sign-In Using Fido2 Security Keys
(Modern Management / Microsoft Entra joined)   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 11
Enable Manually on an Individual Device  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  12
Enable Using Intune Device Configuration Profile  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  13
Enable Using Intune Windows 10 Enrollment Policy  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  16
Documentation & References   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 17

Configuring Windows 10 Sign-In Using Fido2 Security Keys
(On-Premises Ad / Microsoft Entra hybrid joined)  .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .  18
Documentation & References   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   .   . 18

Enabling Support for Fido2 Security Keys
At the time of writing, organizations must enable specific features within their Microsoft Entra ID tenant to support
the self-service registration of FIDO2 security keys for their enterprise Microsoft 365 accounts.
This is not required for personal/consumer Microsoft accounts, which are not subordinated by an organization’s
Microsoft Entra ID implementation.
1. Sign in to the Microsoft Entra ID portal.
2. Browse to Microsoft Entra ID with an account that has sufficient permissions to modify security features(Global Administrator or Security Administrator roles).

Page 2

3. Navigate to Security > Authentication methods.

4. In the Policy pane, select “Click here to enable users for the combined security info registration experience.”

5. In the User feature previews pane, enable the “Users can use the combined security informationregistration experience” setting for either selected groups or all users, then save the configuration.

Page 3

6. In the Policy pane, select FIDO2 Security Key (preview) settings, and configure the following:

7.

a.

Enable – Yesb.

Target – All users or selected users/groupsc.

General –i.

Allow self-service set up – Yesii.

Enforce attestation – Yes

Save the configuration.

Documentation & References- Enable passwordless security key sign-in (preview)• https://learn.microsoft.com/en-us/entra/identity/authentication/
howto-authentication-passwordless-security-key

Page 4

Fido2 Security Key Provisioning and Key Management
In this section, an eligible Microsoft 365 user within the organizational Microsoft Entra tenant can register theirKensington VeriMark Guard FIDO2 security key. At present, administrators cannot provision or de-provision securitykeys on a user’s behalf. Eligible users will need to perform a self-service registration.
1. Browse to https://myprofile.microsoft.com.
2. Select Security Info. If the user does not currently have any Microsoft Entra Multi-Factor Authentication (MFA)
methods registered, they must add a method prior to registering the FIDO2 security key.
3. Select Add method and choose Security key.

4. If prompted, click Next to sign in with two-factor authentication. In the second screenshot below,
the user’s default sign-in method is a Microsoft Authenticator notification.

Page 5

5. Select USB device.

6. Verify that the Kensington VeriMark Guard FIDO2 security key is connected to the device, and click Next.

7. In the Windows Security / Security key setup dialog box, click OK.

Page 6

8. In the Windows Security / Continue setup dialog box, click OK.

9. If prompted, create a PIN for the Kensington VeriMark Guard FIDO2 security key.
This is only necessary during the initial setup of the security key.

Page 7

10. When prompted, touch the security key.

11. When prompted, enter a name for the security key.

12. Verify that the Kensington VeriMark Guard security key is now a registered MFA method.

Page 8

13. Test the security key by signing out (or opening a separate browser session) and navigating tohttps://myprofile.microsoft.com again. At the logon screen, select Sign in with a security key.

14. When prompted, provide the security key PIN.

15. When prompted, touch the security key.

Page 916. If prompted, click Yes to stay signed in.

At this point, the Kensington VeriMark Guard FIDO2 security key is successfully associated with the registered user
and is not specific to the device that was used during the initial registration. The security key is fully portable and canbe connected to other devices to log on as the same registered user account.
Documentation & References- Enable passwordless security key sign-in (preview)• https://learn.microsoft.com/en-us/entra/identity/authentication/
howto-authentication-passwordless-security-key- Set up a security key as your verification method• https://support.microsoft.com/en-us/account-billing/
set-up-a-security-key-as-your-verification-method-2911cacd-efa5-4593-ae22-e09ae14c6698

Page 10

Configuring Windows 10 Sign-In Using Fido2 Security Keys
(Modern Management / Microsoft Entra joined)
Microsoft Entra joined Windows 10 devices support the ability to use FIDO2 security keys at the logon screen
for a fully passwordless experience. This scenario is supported if the following requirements are met:
- Microsoft Entra ID Multi-Factor Authentication (e.g., licensed and enabled in tenant)- Combined security information registration preview- Compatible FIDO2 security keys (e.g., Kensington VeriMark Guard)- Microsoft Entra joined devices require Windows 10 version 1909 or higher

Microsoft offers a variety of broader deployment methods in their documentation;
however, we will provide the following examples:
1. Enable manually on an individual device
2. Enable using Intune device configuration profile (targeted devices)
3. Enable using Intune Windows 10 enrollment policy (all eligible users/devices)

Page 11

Enable Manually on an Individual Device
To manually enable on an individual device for testing, choose a Windows 10 device running 20H1 or greater andlaunch the Local Group Policy Editor. Navigate to Computer Configuration > Administrative Templates > System >Logon, and configure the Turn on security key sign-in setting as Enabled.

If it is necessary to manually test on an older build of Windows 10 without the latest ADMX templates,
the Registry Editor can be used as a workaround.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\SecurityKey]“UseSecurityKeyForSignin”=dword:00000001

Page 12

Enable Using Intune Device Configuration Profile
To target specific device groups to enable the credential provider, use the following custom settings via Intune:
1. Browse to Microsoft Endpoint Manager admin center > Devices > Configuration profiles > Create profile.

2. Configure the new profile with the following settings:- Name: Security Keys for Windows Sign-In- Description: Enables FIDO Security Keys to be used during Windows Sign In- Platform: Windows 10 and later- Profile type: Custom- Custom OMA-URI Settings:• Name: Turn on FIDO Security Keys for Windows Sign-In• OMA-URI: ./Device/Vendor/MSFT/PassportForWork/SecurityKey/UseSecurityKeyForSignin• Data Type: Integer• Value: 1Page 13

Page 14

3. Assign the new device configuration policy to the appropriate users or devices.

4. Customize any required applicability rules and create the policy.

Page 15

Enable Using Intune Windows 10 Enrollment Policy
If a targeted deployment is not necessary, the following method enables security keys for sign-in for all users oneligible Windows 10 devices.
1. Browse to Microsoft Intune > Device enrollment > Windows enrollment > Windows Hello for Business.
2. Under Settings, set Use security keys for sign-in to Enabled.

Page 16Documentation & References- Enable passwordless security key sign-in to Windows 10 devices with Microsoft Entra ID (preview)• https://learn.microsoft.com/en-us/entra/identity/authentication/
howto-authentication-passwordless-security-key-windows

Page 17

Configuring Windows 10 Sign-In Using Fido2 Security Keys
(On-Premises Ad / Microsoft Entra hybrid joined)
Microsoft Entra hybrid joined Windows 10 devices support the ability to use FIDO2 security keys at the logon screen
for a passwordless experience to both on-premises and Microsoft Entra ID–integrated resources. This scenario is
supported if the following requirements are met:
•Microsoft Entra ID Multi-Factor Authentication (e.g., licensed and enabled in tenant)•Combined security information registration preview•

Compatible FIDO2 security keys (e.g., Kensington VeriMark Guard)•Microsoft Entra hybrid joined devices require Windows 10 version 2004 or higher•

Fully patched Windows Server 2016/2019 domain controllers•

Microsoft Entra ID Connect version 1.4.32.0 or later

For more information on how to prepare a hybrid environment for supporting FIDO2 security keys at the Windows 10
logon screen, please refer directly to the following Microsoft documentation.
Documentation & References- Enable passwordless security key sign-in to Windows 10 devices with Microsoft Entra ID (preview)• https://learn.microsoft.com/en-us/entra/identity/authentication/
howto-authentication-passwordless-security-key-windows- Enable passwordless security key sign-in to on-premises resources with Microsoft Entra ID (preview)• https://learn.microsoft.com/en-us/entra/identity/authentication/
howto-authentication-passwordless-security-key-on-premises- Deployment frequently asked questions (FAQs) for hybrid FIDO2 security keys in Microsoft Entra ID (preview)• https://learn.microsoft.com/en-us/entra/identity/authentication/
howto-authentication-passwordless-faqs- Troubleshooting for hybrid deployments of FIDO2 security keys in Microsoft Entra ID (preview)• https://learn.microsoft.com/en-us/entra/identity/authentication/
howto-authentication-passwordless-troubleshootPage 18