---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# FIDO2 as an MFA factor

# FIDO2 as an MFA factor {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of FIDO2 as an MFA factor

FIDO2 is a password-less authentication standard that can be configured as a multi-factor authentication (MFA) factor within ServiceNow.
It enables users to authenticate using physical security keys or biometric methods, offering a more secure alternative to traditional MFA options such as email and SMS.
When enforced, users who meet the factor policy conditions are prompted to register and use FIDO2 for login, enhancing protection against phishing and cyberattacks.
Show full answer Show less  

## Key Features

* **Exclusive FIDO2 Authentication:** High-privilege accounts can be restricted to authenticate only with FIDO2 methods, such as biometrics, passkeys, or hardware security keys.
* **Suppression of Less Secure Methods:** When FIDO2 is the only matching policy, other authentication methods are suppressed to ensure stronger security.
* **Forced Enrollment:** Users who are not registered with a FIDO2 key are required to enroll during login.
* **Granular Control:** Policies can be targeted to specific roles or groups, enabling strict enforcement where needed.
* **User Self-Enroll:** Users have the option to self-enroll their FIDO2 authentication through their user profile settings.

## Practical Application and User Behavior

By configuring FIDO2 factor policies, you can enforce MFA based on user roles and existing enrolled factors. For example:

* Users with an ITIL role and no enrolled factors are prompted to register and use only FIDO2 for login.
* Users with ITIL role and other enrolled factors are redirected to FIDO2 setup, overriding other methods.
* Users with other roles like ASSET can continue to use email or authenticator options unless FIDO2 policy applies.
* Users with multiple roles and enrolled factors can access multiple MFA options and register FIDO2 optionally.

## Benefits for ServiceNow Customers

Implementing FIDO2 as an MFA factor in ServiceNow significantly enhances authentication security by reducing reliance on less secure methods and providing strong, phishing-resistant authentication. This leads to improved protection for high-privilege accounts and tailored enforcement based on organizational roles, ensuring compliance with security policies while maintaining user flexibility.  
You can configure FIDO2 as an MFA factor policy to enforce MFA for yours.

FIDO2 is a password-less authentication standard that enables users to authenticate using a physical security key or biometric authentication. It provides a more secure alternative to traditional MFA methods, reducing the risk of
phishing and other cyberattack.

The FIDO2 factor policy enhancement provides a secure authentication method to your multi-factor authentication (MFA) policies. You can configure FIDO2 as an MFA factor policy option, providing a higher level of security compared to
traditional methods like Email and SMS.

<br />

You can configure FIDO2 factor policy and when the users satisfies the factor policy condition, the during log in to ServiceNow, FIDO2 setup is displayed for the users who haven't already added registered Hardware key or Biometric on their profile.

If the registration is completed, then second factor validation screen is displayed to log in.  
Note:  
FIDO2 can also be self-enrolled by the users. To know more about how to self-enroll, see [Set up Multi-factor authentication on your user profile](https://www.servicenow.com/docs/tL2JlnQsy82CFmVrlpilVA "Enable multi-factor authentication for your account in your user profile settings.").

## Key Benefits {#mfa-with-fido__section_uwx_bgx_bgc}

The following are some of the key benefits of using FIDO2 as an MFA factor:

Exclusive FIDO2 Authentication
:   Ensure high-privilege accounts can only authenticate using FIDO2's strong authentication capabilities (biometrics, passkeys, or hardware security keys).

Exclusion of less secure methods
:   Suppress other authentication methods when FIDO2 is the only matching policy.

Forced enrollment
:   Require users to register a FIDO2 key if not already enrolled.

Granular control
:   Apply strict enforcement to specific roles or groups using policy-based targeting.

As a higher-security factor, FIDO2 has exclusive enforcement capabilities. When it's the only matching policy for a user:

* Overrides other enroll-enrolled factors.
* Forces FIDO2 registration, if the user isn't enrolled.
* Becomes the exclusive authentication option.
{#mfa-with-fido__ul_nkn_lgx_bgc}

## Example Configurations and User Behaviors {#mfa-with-fido__section_ovx_pgx_bgc}

The following table illustrates how different user scenarios are handled based on their roles and enrolled factors.

Example Factor Policy Conditions:

* FIDO2 Factory Policy: Condition is "ITIL role should be true".
* EMAIL Factor Policy: Condition is "ASSET role should be true".

{#mfa-with-fido__mfa-with-fido_ul_vmt_lvr_ngc} {#mfa-with-fido__table_pvx_pgx_bgc__entry__5}

| Example user | Has roles | Already enrolled factors | Matching policies | Behavior |
|-|-|-|-|-|
| andrew.och | ITIL | None | FIDO2 | User is redirected to MFA setup with FIDO2 only. After registration, FIDO2 is the only authentication option. |
| abel.tuter | ITIL | Authenticator | FIDO2 | User is redirected to MFA setup with FIDO2 only, even if the user has Authenticator as self-enrolled factor. Note: If the user hasn't registered to any MFA factor, then the user is redirected to MFA setup with FIDO2. |
| aileen.motterm | ASSET | Authenticator | Email | Sees Email and Authenticator options during log in. The user can choose either factor or optionally register FIDO2. |
| abraham.lincoln | ASSET, ITIL | Authenticator | Email and FIDO2 | Sees Email and Authenticator option during log in. The user can register FIDO2 during validation. After registration, the user can see all the 3 factors. |
[ ]

{#mfa-with-fido__table_pvx_pgx_bgc}

By configuring FIDO2 as an MFA factor policy, you can significantly enhance the security of your authentication processes.