Nitrokey Provisioning for Entra ID

Compatible Nitrokeys
3A/C/Mini	Passkey	HSM 2	Pro 2	FIDO2	Storage 2	Start	U2F
✓ active	✓ active	⨯ inactive	⨯ inactive	⨯ inactive	⨯ inactive	⨯ inactive	⨯ inactive

The Nitrokey 3 and Nitrokey Passkey support provisioning credentials for Microsoft Entra for seamless employee onboarding in enterprise scenarios.

Setup

A Microsoft Entra Application is required to allow for programmatic registration of user credentials. Here we offer you the guide to set up the same provided you have appropriate privileges for the same.

1. Login to Entra Admin portal. Take a note of the primary domain which you will need later. Go to App Registrations on the left blade.

   

2. Select New registration.

   

3. Create a new app and set a name. Click on ‘Register’.

   

4. Take a note of the Client ID and Tenant ID here. You will need it later. Go to API Permissions on the app blade.

   

5. Click on Add a permission.

   

6. Select Microsoft Graph.

   

7. Select Application Permissions.

   

8. Search for UserAuthenticationMethod.ReadWrite.All and select it.

   

9. Search for User.ReadWrite.All and select it (Only if you want to be able to create users from pynitrokey). Click on the Add Permissions button.

   

10. Verify the Granted permissions.

    

11. Click on Grant admin consent and approve it.

    

12. Go back to the app home and select Certificates and secrets from the left blade

    

13. Click New Client secret

    

14. Add a name and expiry, followed by clicking Add

    

15. Make a note of the Client Secret (You will not be able to view it later.)

    

16. Click on Authentication methods from the left blade.

    

17. Select Passkey (FIDO2).

    

18. Click on the Configure tab.

    

19. Click on Default Passkey profile

    

20. Uncheck Enforce Attestation (Only if you are using a Nitrokey that does not have a FIDO Alliance certification. At the time of writing this document, only the Nitrokey 3A Mini has this certification.)

    

21. Click Save.

    

22. You have taken note of the Tenant ID, Client ID, Client Secret and Primary Domain as a part of the process. Make a config.json file with the information. An example is shown below.

    {
        "tenant": "49d2c4c8-9144-49ea-b5f3-fc11b848cd72",
        "client": "e9f25c9c-3870-4aa8-9659-a40f09de093e",
        "secret": "************************************",
        "domain": "Cryptane.onmicrosoft.com"
    }
    

    

Usage

You may use the pynitrokey utility to provision a Nitrokey for an user in your tenant.

nitropy fido2 provision-credential entra -c config.json <username> --create-user

Here the <username> could be the Email ID of the user (User principal in terms of Microsoft) or a part of it till before the @ sign. The –create-user flag directs the tool to create the user if it does not exist in the Entra Tenant.

Verification

The user may use the newly provisioned Nitrokey to login to his Microsoft account. Follow Sample login to Microsoft with Nitrokey for signing in with this newly provisioned nitrokey.

You may verify the provisioned credential from the Entra admin portal following the steps.

1. Go to the Users option from the left blade on Entra admin center.

   

2. If the user was created with the –create-user flag you may be able to find the entry on the list. If it is a pre-existing user, it would also be there. Click on the user to which the credential was enrolled.

   

3. Click on Authentication methods on the user blade.

   

4. The enrolled credential with first 5 characters of the Nitrokey UUID would be visible. You may click the triple dots and then on View details to see detailed information about the enrolled credential.

   

5. Additional information about the credential would be visible. You may validate the same.