To configure FIDO2 passwordless authentication, you must configure a PingFederate policy for a passwordless authentication flow. FIDO2 biometrics must then be enabled in the administrative console.

The process of registering a FIDO2 device is the same for both passwordless and secondary authentication flows. The user is directed to the relevant flow, according to your organization’s configuration. Once registered, the same FIDO2-compliant device can be used to authenticate with either flow. For more information, see Setting up Windows Hello authentication.

Note:

This feature requires PingFederate 9.3 or later. For more information, see FIDO2 biometrics authentication requirements and limitations.

  1. In the PingFederate administrative console, create a policy for passwordless authentication.

    For more information, see Configuring a PingFederate policy for passwordless authentication with FIDO biometrics.

  2. Sign on to the PingOne for Enterprise admin console and enable FIDO2 biometrics.
    1. Go to Setup > PingID > Configuration.
    2. Go to the Alternate Authentication Methods section, and in the FIDO2 Biometrics row, select the Enable check box.

      A screen capture of the Alternate Authentication Methods section.
    3. Click Save.
The changes are saved, and users can pair and authenticate with gestures defined on their FIDO2 biometrics accessing device. For more information, see Using Windows Hello for authentication.