WebAuthn Resources Arrive in Microsoft Graph: Next-Gen Passwordless Admin Visibility

WHAT’S CHANGING

Microsoft has introduced a suite of new WebAuthn resource types into the Microsoft Graph API:

• webauthnAuthenticationExtensionsClientInputs
• webauthnAuthenticationExtensionsClientOutputs
• webauthnAuthenticatorAttestationResponse
• webauthnAuthenticatorSelectionCriteria
• webauthnCredentialCreationOptions
• webauthnPublicKeyCredential
• webauthnPublicKeyCredentialCreationOptions
• webauthnPublicKeyCredentialDescriptor
• webauthnPublicKeyCredentialParameters

These resources power deep visibility into FIDO2 and WebAuthn-backed passwordless authentication flows, credential registration, and attestation events. This change is live now in Microsoft Graph v1.0.

WHO’S AFFECTED

• Entra tenants leveraging passwordless authentication (FIDO2, Windows Hello, security keys)
• Admins managing Conditional Access, MFA, or device registration policies
• Developers integrating custom authentication flows via Microsoft Graph
• Security teams auditing credential lifecycle and attestation
• Entra ID Premium P1/P2 tenants (for advanced passwordless features and reporting)

Tenants not actively using WebAuthn/FIDO2 are unaffected operationally, but should monitor for future adoption as Microsoft expands passwordless scenarios.

WHY IT MATTERS

• Auditing: Full visibility into WebAuthn credential events, attestation, and registration across the tenant.
• Troubleshooting: Faster root-cause analysis for authentication failures, security key problems, or device registration issues.
• Compliance: Attestation responses can be inspected to validate hardware integrity and regulatory requirements.
• Automation: Admins and developers can use Microsoft Graph/PowerShell to automate reporting, alerting, and lifecycle actions.
• Future-proofing: Prepares tenants for expanding passwordless and phishing-resistant authentication mandates.

Previously, these details were opaque or only available in device logs. Now, admins have structured, queryable access to credential data.

WHAT TO DO

1. Review your tenant’s authentication method configuration for FIDO2/WebAuthn usage.
2. Update operational scripts to leverage the new Graph resources for reporting and alerting.
3. Train helpdesk and security staff on interpreting WebAuthn credential details for troubleshooting.
4. Validate Conditional Access and MFA policies—ensure you’re not inadvertently blocking WebAuthn scenarios.
5. Document attestation requirements if your organization mandates only trusted hardware.

For new automation or audit scenarios, start referencing the WebAuthn resource endpoints in Microsoft Graph v1.0. No action required if you’re not using passwordless or FIDO2, but monitor as Microsoft will continue expanding these capabilities.

CHECK IT YOURSELF

Use the following PowerShell (requires Microsoft.Graph module, minimum v2.0) to enumerate WebAuthn credentials and registration events for all users. This script audits current credential objects, handles paging, and provides error output—no modifications, dry-run only.

# Requires Microsoft.Graph module
# Connect-Graph as a Global Admin or Authentication Administrator
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.AuthenticationMethods

try {
    $users = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/v1.0/users?$select=id,displayName' | Select-Object -ExpandProperty value
    $results = @()
    foreach ($user in $users) {
        try {
            $methods = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/users/$($user.id)/authentication/fido2Methods" | Select-Object -ExpandProperty value
            foreach ($method in $methods) {
                $results += [PSCustomObject]@{
                    UserDisplayName = $user.displayName
                    UserId = $user.id
                    CredentialId = $method.id
                    Attestation = $method.attestation
                    CreatedDateTime = $method.createdDateTime
                    Manufacturer = $method.manufacturer
                }
            }
        } catch {
            Write-Warning "Failed to fetch FIDO2 methods for user $($user.displayName): $_"
        }
    }
    $results | Format-Table -AutoSize
} catch {
    Write-Error "Error fetching users: $_"
}

This script provides a tenant-wide report on currently registered FIDO2/WebAuthn credentials, including attestation details. For more granular event data, reference the new Graph resource endpoints directly.

PORTAL PATH

To view passwordless authentication methods in the Entra admin center:

• Entra admin center > Identity > Authentication methods
• Review FIDO2 Security Key registration status and policies
• For user-specific credential details: Identity > Users > [Select User] > Authentication methods

Attestation and credential metadata are now increasingly visible for troubleshooting and auditing.

BOTTOM LINE

• High priority: Audit your FIDO2/WebAuthn usage now—update scripts and operational playbooks to surface these new resources.
• Train staff: Ensure helpdesk and security teams know how to interpret WebAuthn credential and attestation events.
• Monitor for future changes: Microsoft will expand passwordless and WebAuthn support; stay ahead by building automation on Graph resources.
• Review Conditional Access: Confirm passwordless authentication paths are not unintentionally blocked.

Microsoft Graph’s new WebAuthn resource visibility is a strategic enabler for secure, scalable passwordless adoption. Take action now to maximize operational readiness and compliance.