Fixing security token enrollment errors for non-technical users
Asking standard employees to manually navigate certificate tools, templates, and provisioning slots turns simple token setups into 30-minute helpdesk calls. Additionally, strict configurations cause sign-ins to fail with error messages stating that the passkey does not meet the criteria set by the admin.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Purchasing expensive commercial Certificate Management SystemsDid this help you?
- 2Writing custom internal enrollment toolsDid this help you?
- 3Check Conditional Access policy configuration for MFADid this help you?
- 4Verify device requirements like PIN or Face ID settingsDid this help you?
- 5Using device-bound passkeys instead of synced passkeysDid this help you?
- 6Sticking to traditional authentication methods until synced enterprise deployment maturesDid this help you?
- 7Treating Temporary Access Pass (TAP) as the bootstrap method and enforcing phishing-resistant MFA only after enrollment finishes.Did this help you?
- 8Using an Azure app or group automation to temporarily exclude onboarding users from Conditional Access policies requiring authentication strength, then removing the exclusion after a set number of days.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“Asking standard employees to navigate certmgr.msc, pick the right AD CS template, and properly provision Slot 9A usually results in a 30-minute helpdesk call.”source ↗
“Windows hello pops saying it's required to save passkeys on this device > Next > then it runs into a failure and the whole thing breaks.”source ↗
“Essentially the above flow works, but it's not very pretty. It requires that i inform my endusers with a very clear instructruction during the setup”source ↗
“I am getting a “Your sign in was successful but this passkey does not meet the criteria set by your admin” error message.”source ↗
“Trying to force everything during Autopilot made the flow way too fragile”source ↗
Where this came up
People with this problem also raised
- 2Why do privileged Salesforce users have to create separate passkeys?
- 4Risks of adding someone as an authorized user on a credit card
- 2Can multiple Windows users open a KeePass database?
- 2Why is step-up authentication forced and buggy?
- 7How to set up MFA backup methods so you don't get locked out
- 2Why does accounting software force logins for every company file?