> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Enable FIDO2 security key sign-in for Windows
> This is a step-by-step guide as to how to enable FIDO2 security Key sign-in for Windows
# Enable FIDO2 security key sign-in for Windows
### Option One: Enable with Group Policy
* On the **domain controller**, open the **Group Policy Management Console**.
* Locate the policy you want to apply as a GPO to your Windows clients.
* Edit the policy, navigate to the **Computer Configuration** tab, then go to\*\* Administrative Templates > System > Logon\*\*, and select **Turn on Security Key Sign-in**.
* Setting this policy to **Enabled** allows users to sign in using security keys.
* Setting this policy to **Disabled** or Not Configured disables security key sign-in for users.
**NOTE**: Some older servers may not have the **CredentialProviders.admx** GPO template installed. This template is included with newer versions of Windows Server and Windows 10 (version 20H1 and later). If the GPO is missing from your server, follow **Option Two** below.
### Option Two: Add a Registry Key
* To enable security key sign-in using a registry key, deploy the following registry key to all your Windows clients using your preferred deployment tool.
```
REG ADD "HKLM\SOFTWARE\policies\Microsoft\FIDO" /v EnableFIDODeviceLogon /t REG_DWORD /d 1 /f
```
### Create a Device configuration profile
### Option 1: Settings Catalog
* Sign in to the Microsoft Intune admin center
* Browse to **Devices > Windows > Configuration profiles > Create new policy**.
* Configure the **New Policy** with the following settings:
* Platform: **Windows 10 and later**
* Profile type: **Setting catalog**
* Name: **Security Keys for Windows Sign-In**
* Description: **Enables FIDO Security Keys to be used during Windows Sign In**
* Under the **Configuration settings**> click on**Add settings** > Select **Windows Hello For Business** and add below:
* Use Security Key For Sign-in
* Allow Use of Biometrics
* Use Cloud Trust For On-Prem Auth
* Use Remote Passport
* Require Security Device
* Assign the Policy to the Groups that should support TruU login.
### Option 2: OMA-URI method
* To target specific device groups to enable the credential provider, use the following custom settings via Intune:
* Platform: **Windows 10 and later**
* Profile type: **Template** and select **Custom**
* Name: **Security Keys for Windows Sign-In**
* Description: **Enables FIDO Security Keys to be used during Windows Sign In**
* In the Configuration Settings tab, click on Add and enter the following
* Name: **Turn on FIDO Security Keys for Windows Sign-In**
* Description: (Optional)
* OMA-URI: **./Device/Vendor/MSFT/PassportForWork/SecurityKey/UseSecurityKeyForSignin**
* Data Type: **Integer**
* Value: **1**
* Assign the Policy to the Groups that should support TruU login.
***
[Enable Passkey (FIDO2)](/docs/enable-passkey-fido2)
[CyberArk Zero Touch PKI](/docs/venafi-zero-touch-pki)