1. Log into your WorkspaceONE Access tenant as the system administrator.
   • Navigate to Identity & Access Management > Authentication Methods click the pencil icon next to FIDO2.

2. Click Enable FIDO2 Adapter
   • Set the User Verification Preference to required
   • Set the Attestation Conveyance Preference to none
   • click Save at the bottom of the page.

3. Navigate to Identity Provider and click Built-in

4. After the Authentication Methods loads on the Built-in IDP screen click to enable the FIDO2 authentication method.
   • Click Save at the bottom of the screen

5. Navigate to Policies then click Edit Default Policy

6. Click Configuration and click + ADD POLICY RULE

7. Set the Policy to All Device Types
   • Change the switch for registering FIDO2 authenticator to YES
   • Set the authentication method to Password (cloud deployment)
   • Set the fallback method to Password (Local Directory)

8. Move the policy you just built from the bottom to the top.
   • Now click ALL RANGES next to Web Browser. This should be your second policy from the top.

9. Change the first authentication method to FIDO2
   • Click Save at the bottom of the page

10. Click NEXT and SAVE

1. On you Windows 10 Physical device, close the Chrome and re-open it and browse to your WorkspaceONE Access URL.

Do NOT do this in the lab environment. As we will require a physical device with supported authentication Type (See below)

NOTE: This will not work in Chrome Incognito mode.

• You should now see Sign in with FIDO2 Authenticator.
• Click Register your FIDO2 Authenticator

2. Note the authentication form factors on the various different browsers and operating systems. Make sure you are using one of these and not in a virtual lab environment.  

3. Select the euc-livefire.com domain and authenticate using the Mark VMware1! account. Click Sign in

4. At this point the registration for FIDO2 kicks in and you will be asked in by the browser to select how to verify your identity. Click Continue on the pop-up

5. Now type your PIN for the device

6. Give your authenticator method a name and click Save

7. Now click Sign in with FIDO2 Authenticator and use the Face or PIN to authenticate.

8. You should be authenticated with the user Mark to Intelligent Hub.
   • Close the Chrome  and re-open.
   • Experience seemless FIDO2 authentication to Intelligent Hub.

1. Log into the WorkspaceONE Access admin console. This may require you to close the browser and re-open it or use a different browser.
   • Once logged in click on Users & Groups

2. Select the user that you have been doing the tests with. (My case this is Mark Debio)
   • Click Two-Factor Authentication on the user record

3. We are interested in the FIDO2 section on this page where you will find the current security authenticators that have been configured for this user.

4. Select a authenticator and note the options you have to delete, rename and block this authenticator.