PA-06: Require FIDO2 Security Keys for Administrators

PA-06 is a security control that hardware security keys provide the highest authentication assurance. unlike software-based mfa, keys cannot be phished, cloned, or remotely compromised. level 3 mandates this protection for all admin access. It requires that all users with privileged roles have registered fido2 security keys and each admin has at least 2 keys registered (primary + backup), pim activation requires fido2 authentication.

Hardware security keys provide the highest authentication assurance. Unlike software-based MFA, keys cannot be phished, cloned, or remotely compromised. Level 3 mandates this protection for all admin access.

PA-06 requires manual implementation. Requires hardware security key procurement and registration

This control requires Azure AD Premium P2 (included in Microsoft 365 E5) or standalone P2.

PA-06 is included in the Maximum Security baseline (Level 3). This level is designed for high-security environments and regulated industries.

PA-06 is rated critical because failure to implement this control significantly increases the risk of security incidents. Hardware security keys provide the highest authentication assurance. Unlike software-based MFA, keys cannot be phished, cloned, or remotely compromised. Level 3 mandates this protection for all admin access.