Implement FIDO

FIDO was initially designed for consumers to securely access websites. When deployed at the enterprise level, several capabilities are missing from the FIDO2 standard that limits reporting, usability, and internal controls. For example, account enrollment and recovery, as well as passkey tracking and replacement, can be very difficult.

As a new standard, support is still inconsistent across all combinations of browsers, operating systems, and devices. For example, iOS requires a PIN for all authentications, while Android does not support a PIN for authentication. This results in wildly inconsistent user experiences and limits your ability to deploy FIDO broadly across your organization.

Many organizations still rely on protecting their most critical systems and data by using discrete infra- structures not connected to the internet. To use FIDO2 for this application is not practical, as it requires setting up your own IdP and updating all your on-prem applications to federate them to this IdP.