New FIDO2/Passkey Registered to Entra ID Account with Unmanaged Device Correlation

Ethan Andrews@eandrews

•updated Jul 8, 2026•25•0•28

Detects the registration of a new FIDO2 security key or passkey in Entra ID that is associated with a sign-in from an unmanaged or non-compliant device shortly before or after the registration. This behavior often suggests a vishing or social engineering scenario where an attacker guides a user through an authentication method registration process while impersonating IT support.