---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configure FIDO2 as an MFA factor

# Configure FIDO2 as an MFA factor {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Configure policy input and condition to display FIDO2 as an MFA factor policy for authentication.

## Before you begin

Role required: admin

## Procedure

1. Navigate to AllMulti-factor AuthenticationMFA Context.
2. Select the MFA Factor Policies tab.
3. Select the Display FIDO2 as an MFA Factor Policy.
4. Select New to add Policy Inputs.
5. Select the filter criteria that you want to create.  
   Following are the types of filter criteria:
   * [IP Filter Criteria](https://www.servicenow.com/docs/9zwOIp7aRQdufCW83daRgg "IP filter criteria allows you to filter users based on the user's IP addresses. You can configure an authentication policy to allow or deny access to a specific address or range of addresses.")
   * [Role Filter Criteria](https://www.servicenow.com/docs/AUeaKypYR6St_a0qJjM4dA "Role filter criteria allows you to filter users based on the roles. You can configure an authentication policy to allow or deny access to a list of user roles.")
   * [Group Filter Criteria](https://www.servicenow.com/docs/MODA0r872myHjT0~p3ecUg "Group filter criteria allows or denies user access based on the user group to which the user belongs.")

   {#configure-fido-mfa-factor__ul_xjk_24j_xvb}

   For example, Role Filter Criteria.
6. Select Role Filter Criteria, fill the fields for the role filter criteria and submit the record.  
   The new policy is created. For more information, see [Role Filter Criteria](https://www.servicenow.com/docs/AUeaKypYR6St_a0qJjM4dA "Role filter criteria allows you to filter users based on the roles. You can configure an authentication policy to allow or deny access to a list of user roles.").

   Let's take an example of using ITIL role for the user (andrew.och) as the policy input and
   submit.
7. On the Policy - Display FIDO2 as an MFA Factor Policy page, select Policy Conditions.
8. Select New to add policy conditions.
9. On the form, fill in the fields.  
   {#configure-fido-mfa-factor__table_mxz_wyp_znb__entry__2}

   | Field | Description |
   |-|-|
   | Label | Name to identify the condition. |
   | Description | Description of the condition. |
   | Condition | Logical combination of multiple policy inputs (filter criteria) that is used to evaluate authentication requests. Select the role-based filter criteria policy that was created for the condition. |
   [Table 1. Condition form]

   {#configure-fido-mfa-factor__table_mxz_wyp_znb}
10. Select Submit.  
    Based on the policy input and condition, if the user (andrew.och) tries to log in to the instance, the user is shown as the FIDO screen to either enroll and register.

    <br />

    To know more about different configuration example and user behaviors, see [Example Configurations and User Behaviors](https://www.servicenow.com/docs/hd_X4OZ_4QOx9IYpJ3ke0Q#mfa-with-fido__section_ovx_pgx_bgc).
11. **Optional:** Repeat step 8 to create additional policy conditions.  
    Note:  
    If you create multiple policy conditions, the final output of the access policy depends on the logical OR output of the all policy conditions. Based on the conditions the policy is evaluated.
{#configure-fido-mfa-factor__steps_xln_rsj_xvb}

*[\>]: and then