NF Software Inc.

Microsoft 365 Advanced Security Guide

2026-06-30T00:00:00+00:00

Overview

When it comes to IT security, the threat landscape has become an advanced, persistent, and dangerous problem to deal with. Microsoft 365 is no exception, there are constantly phishing, hacking, and ransomware attacks that are ongoing and widespread. If you think your organization is too small for anyone to care, think again!

There are a number of tips and techniques that are built into the Microsoft 365 platform to help in mitigating these problems. Some of which are included with basic licensing such as Microsoft 365 Business Standard and others of which require special licenses such as Microsoft Entra ID P1.

This article will help to secure your Microsoft 365 tenant using a mix of security hardening practices and user awareness improvements. Below are the main categories that this article covers.

Portal Branding & Customization
Edge & Teams Customization
Baseline Security Mode & Conditional Access

Portal Branding & Customization

Branding Overview

Why customize the portal with your brand and other changes?

I mean sure, it looks a little nicer, but does it really matter? This is where the user awareness comes into play. With the level of sophistication we are seeing these days with phishing attacks, combined with a busy day for the average employee, even multifactor authentication secured accounts are being breached.

How does this happen? First, your employee will receive an email with a link they probably should know better than to click, but they’re swamped with deadlines and it looks real, so they click it and before they realize what has happened they have entered their username, password, and a 6-digit MFA code. This has just provided the attacker with a 30-second window to log into their account, and as long as the session is kept alive by clicking a link every now and then, it can silently remain as a dormant breach while data is being harvested and plans are made for the real attack.

Long story short, yes, branding and customization can increase security. It takes a generic sign-in page and transforms it into your company sign-in page. Now when your team goes to log into Microsoft 365 services they will see your logo and your colours, which are instantly recognizable. With proper training, the team will also know that anything else is wrong.

Branding Requirements

Favicon, 32x32px
Background image, 1920x1080px
Square logo, 240x240px
Rectangular logo, 200x48px
3 colours
Custom company domain (optional)

Branding Steps

Create Domain Redirect

This one is optional and will differ a little depending on your domain registrar. Again, this increases user awareness. Simply add a URL redirect for your company domain to the primary domain in your Microsoft 365 tenant. You can choose whatever you would like but I typically go with portal as the prefix so it feels familiar.

portal.mycompany.com => https://myapps.microsoft.com/mycompany.com

Create a Custom Company Theme

In the Microsoft 365 admin center:

Click Show all
Click Settings -> Org settings -> Organization Profile -> Custom themes
Then either click + Add theme or … -> Edit if there is an existing theme
Select your preferences on the General tab, I usually enable both
Go to the Logos tab and upload your rectangular logo
Go to the Colors tab and enter your company colours

Create a Custom Company Login Page

In the Microsoft 365 admin center:

Click to open the Identity admin center
Click on Entra ID -> Custom branding -> Edit
Select your favicon, background, and background colour, then click Next: Layout >
Select your preferred layout and click Next: Header >, I usually leave the defaults
Add your rectangular logo if you enabled the header, then click Next: Footer >
Select your preferred options and click Next: Sign-in form >
Select your rectangular logo and square logo, then click Next: Review >
Click Save

Edge & Teams Customization

App Customization Overview

Similar to the portal customization, Microsoft Edge and Teams can be customized to help unify the look and feel of those applications. Additionally, there are several security settings in Edge that can be implemented to improve your company security. That said, you will need to promote Microsoft Edge as the primary work browser (or for limited purpose devices such as kiosks this can be enforced as the only allowable browser).

Microsoft Edge Customization

First, if you do not have groups set up, you will need to make one or two; I typically make one for users and another for devices.

In the Microsoft 365 admin center:

Click Show all
Click to open the Identity admin center
Click on Entra ID -> Groups -> All groups
Click New group
Select Security as the Group type, enter a name, and select Assigned as the Membership type
Click No members selected, then add users and devices to the group
Click Create

Now you can start making the customizations to Microsoft Edge.

In the Microsoft 365 admin center:

Click Settings -> Microsoft Edge -> Configuration Policies
Then click + Create policy
Enter a name such as General Customizations and select the target Platforms (I usually target all)
Click Next until the final screen then click Review and save
Click to open the new policy
On the Properties tab click Edit on the Assignments header
Then click Select group and type in the name of the new group, then click Select
Save the policy and return to the Properties tab and click Edit on the Settings header
For each of the following click + Add setting and type in the name
- AllowGamesMenu => Disabled, no user override
- AllowSurfGame => Disabled, no user override
- AutoImportAtFirstRun => Disabled, no user override
- BingAdsSuppression => Enabled, no user override
- EnhanceSecurityMode => Balanced mode, no user override
- ForceBingSafeSearch => Moderate, no user override
- ForceGoogleSafeSearch => Enabled, no user override
- ForceYouTubeRestrict => Moderate, no user override
- GamerModeEnabled => Disabled, no user override
- HideFirstRunExperience => Enabled, no user override
- HomepageIsNewTabPage => Enabled, allow user override
- NewTabPageHideDefaultTopSites => Enabled, no user override
- NewTabPageManagedQuickLinks => Add up to 3 links here, allow user override
- NewTabPageQuickLinksEnabled => Enabled, no user override
- NewTabPageSetFeedType => Office 365, allow user override
- PasswordExportEnabled => Disabled, no user override
- ScarewareBlockerProtectionEnabled => Enabled, no user override
- ShowDownloadsInsecureWarningsEnabled => Enabled, no user override
- SmartScreenEnabled => Enabled, no user override
- ThirdPartyPasswordManagersAllowed => Enabled, no user override
- WalletDonationEnabled => Disabled, no user override

Also consider the following settings carefully, I would recommend using a password manager tool such as Passbolt or Bitwarden as they are far more secure than the browser-based password managers. One problem is that if an account is compromised, the attacker could export saved passwords from Microsoft Edge if the passwords are synced.

ImportPasswordsDisabled => Enabled, no user override
ImportSavedPasswords => Disabled, no user override
PasswordManagerEnabled => Disabled, no user override

Finally, there is some branding for Microsoft Edge and additional security settings.

Save the policy and go to the Customization Settings tab
Click into Organization branding
Select to Use custom branding
Enter the Organization name, Accent color, and Organization logo (square)
Click Security settings
Enable the Configure enhanced security mode box and select Balanced

Microsoft Edge Web Content Filtering

This section requires one of a Microsoft 365 A1, A3, A5 license, a Business Premium license, or a Business Basic or Standard license with Intune Plan 1 or 2. This can also be done in the Defender portal depending on licensing but it is much simpler in the main portal if your requirements are not too complex.

Also note, it is possible your tenant is not on the latest release and the Web content filtering tab will simply not be present. If this is the case and you have the required licensing you may need to open a support case to request access.

For edge and limited use devices such as kiosks you may want to really lock things down. You can enable the web content filter which limits what content can be accessed via Microsoft Edge and enforces that Microsoft Edge is the only browser used.

In the Microsoft 365 admin center:

Click Show all
Go to Settings -> Microsoft Edge -> Configuration Policies
Either click to create a new policy or select an existing policy
Click Customization Settings -> Web content filtering
Select the categories to block and save the policy
Additionally, you can manage allowed, blocked, and requested sites

Microsoft Teams Customization

This section requires a Microsoft Teams Premium license.

This is not really a security enhancement, but since the branding has already been rolled out across the portal and Edge it is a natural extension to continue here.

In the Microsoft 365 admin center:

Click Show all
Click to open the Teams admin center
Go to Meetings -> Customization policies -> + Add a theme
Add a name
Add the rectangular logo, and background image, and colour from earlier
Click Apply
Click Save

Baseline Security Mode & Conditional Access

Security Settings Overview

While the first section focused on user awareness security improvements, and the second section focused on a mix of that and security hardening, this section focuses only on security hardening.

There are two parts to this section, Baseline Security Mode and Conditional Access. The former is part of every Microsoft 365 tenant and should be reviewed and updated, while the latter is a licensed option that is very much worth consideration.

Baseline Security Mode

While there are a slew of different security settings and places to enable them in Microsoft 365, one that is included with all tenants is the Baseline Security Mode. This contains several key security recommendations related to authentication, file access, and Microsoft Office settings. The steps below outline how to get there and make changes, but there is also a lessor know URL that allows you to create custom policies and custom Microsoft Office installers, along with some other handy tools Office Settings Portal.

In the Microsoft 365 admin center:

Click Show all
Go to Settings -> Org settings -> Security & privacy
Then click Baseline security mode
In the popout
- You can initiate generating reports to view usage of related policies
- You can click to enable one or both of the default policy sets
- Or click to Open Baseline security mode
In the Baseline security mode window
- You can review generated usage reports
- Enable individual policies
- Click Customize this policy to make adjustments

You will need to review the policies to see if there are any apps accessing these protocols or modes. Sometimes other systems such as backup systems or third-party cloud services may be authenticating with an older method.

Authentication Methods

Before diving into the security settings, it’s worth looking at multifactor-authentication methods and configuring them to improve overall security.

The methods are:

Temporary Access Pass
Voice call
Email OTP
SMS
Software OATH tokens
Hardware OATH tokens
Microsoft Authenticator
QR Code
Verified ID
Certificate-based authentication
Passkey (FIDO2)

These include 3 strength categories that will help with the Conditional Access policies, those being: MFA, Passwordless MFA, and Phishing-resistant MFA. Each of which is successively higher strength. Full details at Microsoft Learn.

One key difference between these are that a regular MFA, and even Paswordless MFA, method are still subject to Man-In-The-Middle attacks and MFA Fatigue attacks, whereas Phishing-resistant MFA is very tough to bypass. Practically speaking, what does this mean though?

Basically, with regular MFA, if a code is provided to someone over the phone or entered into a malicious website, the attacker then has up to 30 seconds to use it to log in and establish a session; or for passwordless MFA, if an attacker has acquired the users’ password and sends one or more push notifications, one of which gets accepted, they can establish a session. But with phishing-resistant MFA, the user has a physical token they need to use for logging in.

Note that while the enforcement of particular MFA methods is part of the Conditional Access which requires additional licensing, all of the MFA methods are allowed on every tenant.

Conditional Access

This section requires a Microsoft Entra ID P1 or P2 license.

Conditional Access is a set of policies that allow governing access to your tenant based on a variety of different factors such as geographic location, requested resources, device type, user account or group, and risk policy (P2 only). You can also configure what type of sign-ins are allowed or blocked and combine this with session expiry durations. Combined, these can significantly increase security with little to no perceived increase in user requirements.

You will need to customize things to your own organization, but the set of policies below can be a good starting point in many cases.

First, if you do not already have them, create two “break glass” accounts that will be assigned the Global Administrator role for the entire Microsoft 365 tenant. This is extremely important so you do not accidentally lock yourself out and also a standard practice recommended by Microsoft. I would recommend configuring both accounts with phishing-resistant MFA such as a YubiKey and storing the account passwords somewhere safe such as a password management system or even in a company safe. These accounts should only be used if all other accounts are inaccessible.

Next, groups should be created to target the policies to.

In the Microsoft 365 admin center:

Click Show all
Click to open the Identity portal
Click Groups -> All groups -> New group
Leave the Group type as Security
Enter a Group name
Leave Membership type as Assigned
Repeat as required
Suggested are Conditional Access Admins, Conditional Access Users, and Conditional Access Travel

Then, creating Named locations to target policies.

Click Conditional Access -> Named locations -> Countries location
Check off any countries your organization operates within
Click Create
Then create another and select all countries your organization is not in
Be sure to click Include unknown countries/regions
If you have static IP addresses create one or more IP ranges location
Provide a Name, check the Mark as trusted location box
Enter any static IP addresses for the organization

And finally, creating the policies.

Click Conditional Access -> Policies -> New policy from template
Click the Block legacy access policy template
Click Review + create
Return to the policy screen and click to add a New policy
Use the tables below to create policies as required
Leave policies at Report-only to start
Change to On after a few days have gone by and reviewing the report data

Review each of these to make sure it fits with how your organization operates. The main concept here is that most attacks come from out of country, so the heaviest restrictions are placed there; whereas the fewest attacks come from in the office, so the least restrictions are placed there.

Admin – In Country

Action: Grant access

	Include	Exclude
Users	Application Administrator Authentication Administrator Billing Administrator Cloud Application Administrator Conditional Access Administrator Dynamics 365 Administrator Dynamics 365 Business Central Administrator Exchange Administrator Global Administrator Helpdesk Administrator Intune Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator Security Administrator SharePoint Administrator Teams Administrator User Administrator Windows 365 Administrator	Break glass accounts
Resources	Microsoft Admin Portals
Network	In-country IPs	In-office static IPs
Platforms
App Types

MFA Requirements: Phishing-resistant MFA.
Session Length: 4 hours

Admin – In Office

Action: Grant access

	Include	Exclude
Users	Application Administrator Authentication Administrator Billing Administrator Cloud Application Administrator Conditional Access Administrator Dynamics 365 Administrator Dynamics 365 Business Central Administrator Exchange Administrator Global Administrator Helpdesk Administrator Intune Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator Security Administrator SharePoint Administrator Teams Administrator User Administrator Windows 365 Administrator	Break glass accounts
Resources	Microsoft Admin Portals
Network	In-office static IPs
Platforms
App Types

MFA Requirements: Standard MFA.
Session Length: 4 hours

Block – Admin – Out of Country

Action: Block access

	Include	Exclude
Users	Application Administrator Authentication Administrator Billing Administrator Cloud Application Administrator Conditional Access Administrator Dynamics 365 Administrator Dynamics 365 Business Central Administrator Exchange Administrator Global Administrator Helpdesk Administrator Intune Administrator Password Administrator Privileged Authentication Administrator Privileged Role Administrator Security Administrator SharePoint Administrator Teams Administrator User Administrator Windows 365 Administrator	Break glass accounts
Resources	Microsoft Admin Portals
Network	Global IPs	In-office static IPs
Platforms
App Types

MFA Requirements:
Session Length:

Block – Users – Out of Country

Action: Block access

	Include	Exclude
Users	All users	Break glass accounts Conditional Access Travel
Resources	All resources
Network	Global IP	In-office static IPs
Platforms
App Types

MFA Requirements:
Session Length:

Block – Legacy Authentication

Action: Block access

	Include	Exclude
Users	All users	Break glass accounts
Resources	All resources
Network
Platforms
App Types	Exchange ActiveSync clients Other clients

MFA Requirements:
Session Length:

Users – In Country (Windows)

Action: Grant access

	Include	Exclude
Users	All users	Break glass accounts
Resources	All resources
Network	In-country IPs	In-office static IPs
Platforms	Windows
App Types

MFA Requirements: One of Passwordless MFA or Microsoft Entra Hybrid joined device.
Session Length: 14 days

Users – In Office

Action: Grant access

	Include	Exclude
Users	All users	Break glass accounts Directory Synchronization Accounts
Resources	All resources
Network	In-office static IPs
Platforms	Windows
App Types

MFA Requirements: Standard MFA or Microsoft Entra Hybrid joined device.
Session Length: 90 days

Users – In Country (Non-Windows)

Action: Grant access

	Include	Exclude
Users	All users	Break glass accounts
Resources	All resources
Network	In-country IPs
Platforms	Android iOS macOS Linux
App Types

MFA Requirements: Passwordless MFA.
Session Length: 14 days

Users – Out of Country

Action: Grant access

	Include	Exclude
Users	Conditional Access Travel	Break glass accounts
Resources	All resources
Network	Global IP	In-office static IPs
Platforms
App Types

MFA Requirements: One of Phishing-resistant MFA or Microsoft Entry Hybrid joined device.
Session Length: 1 day

Author

Nathanael Frey

Welcome to the NF Software Blog

2026-05-19T00:00:00+00:00

Hey! Thanks for stopping by.

This blog is a place to document and share practical experience from real-world software work.

If you’re looking for clear, direct explanations and working solutions to real problems, you’ll feel at home here.

What to Expect

This blog will cover topics relevant to our work, including:

Software design and architecture
Development practices and tooling
Notes on open-source projects

Why This Exists

A lot of useful knowledge in software development never gets written down.

It lives in:

internal discussions
one-off fixes
hard-earned experience

This blog exists to capture that knowledge in a way that is:

Practical — directly usable
Precise — no unnecessary abstraction
Durable — still useful months or years later

Feedback

If you have questions or related ideas, feel free to leave a comment below.

Author

Nathanael Frey

Setting Up BitLocker with YubiKey as Smart Card

2021-01-09T00:00:00+00:00

Overview

This guide provides steps to configure a BitLocker encrypted drive that can be unlocked with a YubiKey 5 series device in Smart Card mode. This will result in a BitLocker drive that is secured by a physical piece of hardware and only requires typing in your YubiKey PIN to unlock.

2022-01-17 UPDATE: Step 7 has been updated to improve the completeness of configuring the YubiKey. This will be particularly helpful to anyone with multiple keys, but good for those without as well.

Requirements

Windows 10 Professional (or higher)
YubiKey 5 series (tested with 5Ci, 5C Nano, and 5 Nano)
External drive, USB key, or virtual hard drive

Configuration Steps

1. Install Required Software

Download and install the YubiKey Manager, YubiKey Smart Card Minidriver, and optionally Yubico Authenticator apps.

YubiKey Manager
YubiKey Smart Card Minidriver
Yubico Authenticator: Windows 10, Android, iOS

The authenticator app is not required for this guide, but it is useful for registering two-factor authentication (2FA) tokens to your YubiKey.

2. Create Certificate Request

Create a text file with the following contents to use as a certificate request. I have set the certificate request to generate a certificate that is valid for 99 years; but you can change the ValidityPeriodUnits if a different amount of time is desired. You may also change the OID value, only do so if you have a reason for it. The name of the file does not matter, but I have used bitlocker-certificate.txt.

[NewRequest]
Subject = "CN=BitLocker"
KeyLength = 2048
HashAlgorithm = Sha256
Exportable = TRUE
KeySpec = "AT_KEYEXCHANGE"
KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE"
KeyUsageProperty = "NCRYPT_ALLOW_DECRYPT_FLAG"
RequestType = Cert
SMIME = FALSE
ValidityPeriodUnits = 99
ValidityPeriod = Years

[EnhancedKeyUsageExtension]
OID=1.3.6.1.4.1.311.67.1.1

3. Enable Self-Signed Certificates

Open the Registry Editor and add the following key. Press Windows + R, then type in regedit, and click OK to open the Registry Editor.

Browse to: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
Right-click in the window pane on the right and select: New -> DWORD (32-bit) Value
Type the following name for the key: SelfSignedCertificates
Double-click the key to open it and set the value to: 1

4. Configure Group Policy

Open the Local Group Policy Editor to ensure that smart card certificates are properly configured for use with BitLocker. To open the Local Group Policy Editor press Windows + R, then type gpedit.msc, and click OK.

Browse to: Local Computer Policy -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption
Double-click to open: Validate smart card certificate usage rule compliance
Set the rule to: Enabled
Ensure that the Object identifier: is set to 1.3.6.1.4.1.311.67.1.1 (or if you changed the OID in step 2 it must match that value)

5. Generate Certificate

Open PowerShell to generate the certificate to use with BitLocker and the YubiKey. This is the certificate that will be loaded onto the YubiKey.

Change directory to where you saved the text file from step 2
Run the following command: certreq -new .\bitlocker-certificate.txt
Enter a name for the request file such as: bitlocker-certificate.req
Delete the .req file as it is not needed
Delete the .txt file from step 2

6. Export Certificate

Open the certificate manager to export the newly created certificate in a format that can be loaded on to the YubiKey.

Open the Windows start menu and type: Manage user certificates
Click to open the certificate manager program
Browse to: Certificates – Current User -> Personal -> Certificates
There you will see a certificate titled BitLocker
Right-click and select: All Tasks -> Export…
Click Next, then select Yes, export the private key, then click Next again
Click Next, then check the Password: box, and enter a password for the certificate (I used ‘1’ as this file will be deleted later anyhow)
Click Next, then Browse… and save the file as bitlocker-certificate.pfx, then click Next, and finally Finish

7. Configure the YubiKey(s)

Open the YubiKey Manager program to import the certificate to your YubiKey.

If not already done, insert your YubiKey into your PC
Open the YubiKey Manager app
Go to: Applications -> PIV -> Configure Certificates -> Card Authentication
Click Import and browse to and select the bitlocker-certificate.pfx file
Type the password you assigned to the certificate in step 6
Check the Use default box on the Management key screen and click OK
Delete the bitlocker-certificate.pfx file from your PC (may want to wait until completely finished for this)

2022-01-17 UPDATE

After further testing, I have found that it can be helpful to configure the PIN Management section of the YubiKey as well. This is primarily to ensure that configuring multiple keys works without issue, but should also ensure that your keys are set up in the most secure way. These additional steps will provide a standard configuration.

With the YubiKey Manager program still open go to: Applications -> PIV -> Configure PINs
If not already done, click Change PIN to update the PIN to something other than the default
Then, from the Configure PINs screen, click Change PUK
Add a PUK that is different than your PIN, this is essentially your backup PIN
Then, from the Configure PINs screen, click Change Management Key
Click Generate, and ensure the Protect with PIN box is checked
Repeat this process on your other keys, be sure to copy the generated key to those keys

Note that the management key should be the same on all of your keys and also kept secret. That is, only click Generate on the first YubiKey. If you would like to add another YubiKey in the future you will need to store this key as you cannot retrieve it. For further information on PIN management see the YubiKey documentation.

8. Enable BitLocker with Smart Card

Encrypt your device with the now configured YubiKey. Once this step is completed you will have an encrypted drive that can be unlocked with your YubiKey.

Connect your storage device to your PC
Open File Explorer and go to This PC
Right-click on the device you would like to encrypt with BitLocker
Click Turn on BitLocker
Check the Use my smart card to unlock the drive box and click Next
Select one of the options to backup your recovery key. This is important, as if you lose your YubiKey this will be the only way to unlock your drive
Click Next and then select how much of your drive to encrypt. I typically select Encrypt entire drive (slower but best for PCs and drives already in use)
Click Next and then select which encryption mode to use. I typically select New encryption mode (best for fixed drives on this device)
Click Start encrypting
That’s it, you are now ready to unlock your encrypted drive with your YubiKey
Remember to empty your Recycle Bin to permanently delete the certificates that were used during setup

9. Verify the Results

Verify that everything worked as expected. If for some reason things are not working remember that you can use the recovery key from the previous step to unlock the drive at any time.

Right-click on your device in File Explorer and select Eject
Remove the device and re-insert it into your PC
Click on the device in File Explorer to bring up the BitLocker menu
Click Use smart card
Enter the PIN you have set on your YubiKey (default is 123456, but I would highly suggest changing it)
Your drive should now be unlocked

10. Bonus Step - Multiple Keys

If you are like me you may have a second YubiKey in case you lose one of them. The great news is that you can use more than one YubiKey to unlock the same device.

With the YubiKey you just configured inserted into your PC open the YubiKey Manager app
Go to: Applications -> PIV -> Configure Certificates -> Card Authentication
Click export and save the file as bitlocker-certificate.crt
Remove your first YubiKey from your PC and insert your second YubiKey
Go to: Applications -> PIV -> Configure Certificates -> Card Authentication
Click Import and browse to the .crt file that was just exported
Check the Use default box and click OK
Delete the bitlocker-certificate.crt file

That’s all for setting up another YubiKey. Now you should be able to unlock your BitLocker drive with either key.

Author

Nathanael Frey

Discussion (Archived)

The following comments were migrated from the original blog and are preserved for reference. Legacy comments are read-only. Use live comments below for discussion.

JR says:

2021-10-06 at 20:40

When trying to import the crt on the second yubikey, I’m getting an error “Could not deserialize key data”

Any suggestions?

Nathanael Frey says:

2021-11-29 at 20:17

Hi JR,

Did you use the instructions in the Bonus Step section of this article? When you export your key from the YubiKey Manager it should be in the correct format for use with other YubiKeys. Also, did you make sure that you entered the password set in step 6 correctly?

Not that this should make a difference, but which type of YubiKey are you using? I have tested this on 5Ci and 5NFC. As best I can tell anything in the 4 or 5 series should be ok. I see they have a few other products though.

Nathanael

Steve Le says:

2021-10-13 at 02:19

Hi Nathanael,

Thank you for a beautiful post. I’ve tried doing all your steps successfully but BitLocker said “A suitable certificate for BitLocker can’t be found on your SmartCard”.

I’m using Windows 11. Any thoughts about fixing the problem? I’m looking forward to a resolution, digging my research on Google but failed miserably .

Best regards,

Steve

Nathanael Frey says:

2021-11-29 at 20:06

Hi Steve,

I did a bit of checking into BitLocker for Windows 11. Does not look like there have been any changes there, so that is likely not a factor.

Sounds like either the certificate that was generated is not compatible with BitLocker or the certificate was not properly imported to the YubiKey. If the certificate was generated incorrectly, regenerating the certificate may work (steps 2, 5 to 7). The first time I tried getting things working I had to repeat the steps and that worked for whatever reason. I guess something must have been slightly off on my first attempt. If you used a different OID in steps 2 and 4 I would recommend using the one in the article (also recommended by Microsoft). I have also posted a screenshot of what it looks like in my YubiKey Manager in the Certificates screen. You must use the Slot 9e certificate from everything I have found.

Nathanael

Enaske says:

2023-10-06 at 16:52

Same Error for me, might be a bit old.

Followed the Guide 2 times also changed the Certificate that is used to encrypt drives in User Accounts because it was the wrong one, but still no luck.

It says: No valid Smartcard found after entering the PIN for my Yubikey.

Nathanael Frey says:

2024-09-30 at 17:39

Hi Enaske,

I hope you figured things out, been a while since I checked the comments here.

I have seen this when I had multiple devices in play. For example when setting things up between my desktop and laptop the second device gave me this error. I think I just needed to install the minidriver listed in step 1 to resolve; I suspect you have already done this. If you configured your YubiKey on another device I would suggest trying to configure BitLocker there too.

matt says:

2021-12-14 at 02:08

I’m skeptical that this method is actually based on PIV / Yubikey.

If you are exporting the Private key and importing it into Windows then there is no point in having a PIV Smart Card.

Is my understanding correct?

Nathanael Frey says:

2021-12-14 at 09:47

Hi Matt,

A valid concern, but not to worry, if you follow this guide the key will not reduce the security.

The private key is simply to verify the authenticity of your smart card (or in this case YubiKey). The actual authentication is part of the smart card system itself, so you still need to have a smart card with the key loaded. That said, if you were to export the private key and load it on to another YubiKey, that key could then be used to unlock your BitLocker drive. The important thing here is that when the key pair is imported into Windows, the private key is not marked as exportable. The method to import the key pair used in this guide does not allow exporting afterwards.

This is also why I suggest in Step 7 to delete the .pfx file. Once that file is gone, you will not be able to export the private key (unless you allowed it via Windows or the YubiKey Manager during import there). To verify, you can type ‘Run’ into the start menu, then type MMC there, under File -> Add/Remove Snap in…, add the Certificates snap-in and select My user account. Then under Certificates – Current User -> Personal -> Certificates you will find your BitLocker key. Right click it and select All Tasks -> Export. If the private key can be exported you will likely want to reload the key on your system so that it cannot be exported. Should look like the screenshot below.

Nathanael

MJ says:

2022-03-08 at 19:01

Thanks for the great post!

Have you had any luck using ECC certificates for Bitlocker?

I tried a few times myself but couldn’t get it to work. I have read some places that for some reason it’s not possible…

https://superuser.com/questions/1547656/why-cant-i-add-an-elliptic-curve-certificate-smartcard-yubikey-piv-as-prote

Keep us posted if you achieve anything!

Mike says:

2022-05-20 at 12:50

Are there any articles out there for an admin to provision YubiKeys for domains users?

Nathanael Frey says:

2022-06-23 at 10:18

Hi Mike,

I talked with some people at yubico a while back on this topic and while they do have software to help with domain provisioning, it is only available with the YubiEnterprise subscription service. That service has a minimum requirement of 750 users, so for small and medium companies it just is not affordable.

During that call they did direct me to one of their partners AuthLite. In this case, we ended up giving their product a try and it is definitely something that I would recommend. Their product provides the ability to manage MFA for all domain users without the need to install additional software on client machines (just one lightweight app to install on Domain Controllers). Typically, just appending the MFA code to the username field is all that is required. This also works for integrated services such as VPNs (can confirm that Cisco AnyConnect works with AuthLite). Best of all, AuthLite will not break the budget!

Nathanael

Dominik says:

2022-05-26 at 15:22

Hey, very nice tutorial! I did not find FVE in step 3, so I created it myself. Bitlocker still says it cannot find a usable certificate.. I am guessing it is because of this? What could be the reason for the missing node?

Nathanael Frey says:

2022-06-23 at 10:23

Hi Dominik,

I am not sure why the FVE key would be missing; upon checking my current PC, I am also missing the FVE key. I would suggest to right-click on the Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft and select New -> Key. Then name this Key FVE. After this you will be able to perform step 3.

Nathanael

Fox says:

2022-06-30 at 10:10

My FVE folder was missing as well, until I enabled the “Validate smart card certificate usage rule compliance” from step 4 that it showed up in the registry editor.

I suggest enabling that and then going back to step 3 and continuing. Hope this helps!

Marko says:

2022-09-01 at 04:48

Thank you for this guide. It works on Windows 10 Pro and Windows 11 Pro for me as of Septemner 2022.

I want to add that I lost quite a lot of time for error “A certificate suitable for BitLocker can’t be found on your smart card.”, and it’s most probably related to the fact that I initially did not install YubiKey Smart Card Minidriver. It is clearly written in the first step but I managed to ignore it on first attempt and then skipped over it as “already done” when reading again and again the instructions. Just writing this if it will save time to somebody else.

Joseph says:

2022-11-23 at 23:00

I don’t get the option to” Use my smart card to unlock the drive” when turning on bitlocker for the system drive. Does this method not work for system drives? I can enable it for my other partition.

Nathanael Frey says:

2022-11-24 at 14:23

Hi Joseph,

BitLocker on boot drives can use one of the following to unlock: TPM chip, PIN, or password. As per Microsoft documentation smart cards are not supported for this situation.

Trevor Case says:

2023-01-04 at 22:36

Just got a few yubikeys (5Ci) in and wanted to start utilizing them for things. In my case Step 3 and 4 were reversed. Once I completed Step 4 then the FVE directory in regedit appeared with the correct OID versioning.

Thanks for the guide!

Benjamin Phillips says:

2023-03-10 at 10:19

Just a heads up, when you do the export process inside of the manage certificates section, I had to change the encryption to RSA or I’d get an out-of-index range error. Once this was exported with RSA it was able to be imported into my Yubikey

Bill Bremer says:

2023-12-20 at 19:29

After following these steps, would I be able to mount the encrypted drive on another, unmodified Windows Pro computer using the Yubikey? Would the other computer likely need configuration changes before I could unlock the drive?

Nathanael Frey says:

2023-12-21 at 10:45

Hi Bill,

You may need to install the YubiKey Smart Card Minidriver mentioned in Step 1 on the target machine. As for the Bitlocker requirements there should be no issue. Although, if memory serves correctly, I believe when I set up my current laptop I was able to unlock the drives without any extra setup.

Bill Bremer says:

2024-11-03 at 10:04

After installing the certificate on the Yubikey, can I then delete the certificate in the Windows certificate manager?

Nathanael Frey says:

2024-12-22 at 18:42

Yes, you can delete the certificate after everything is set up. The public portion of the key will be added back whenever you unlock the drive, but that’s not a concern.

Pawel says:

2024-01-12 at 08:19

What should I do if, in accordance with Step 3, I do not see the ‘FVE’ folder in the location ‘Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE’ (while I am also unable to create it, as the system indicates that it already exists), and the computer is operating in a Windows domain?

Nathanael Frey says:

2024-01-28 at 14:26

Hi Pawel,

If your PC is on a domain you would likely need to contact your IT administrator for help with this step.

Or, if you have another PC available that you have administrative rights to, you could use that one for the configuration of the BitLocker drives (assuming it is not an internal drive on the PC in question). You can still use the domain PC to unlock the drives, just complete Step 1 so that the domain PC has the required drivers for the YubiKey.

Nathanael

Peter says:

2025-01-10 at 08:55

Easy, just do step 4, then step 3. That sets up the FVE folder in the registry.

Eden says:

2024-04-04 at 12:00

Thanks for the guide! I followed the guide and it works perfect for an external usb drive. but i started using the guide to use it for my internal C drive. and it just doesnt work. When i click on turn on bitlocker the window with “Use my smart card to unlock the drive” just doesnt appear. It just skips right to the window where you save the key. How can i fix this?

Nathanael Frey says:

2024-04-04 at 13:08

Hi Eden,

I do not believe that using a YubiKey as the unlocker for the operating system drive is currently possible using the options built into Windows. For operating system drives you can do one or both of TPM or boot PIN. There are 3rd party software products such as DriveLock and Cryptware listed on the Yubico website that can do this; although it is likely none of these are free.

Valentin says:

2024-08-19 at 08:04

Thanks for the guide!

I am trying to create a PowerShell-Script that automatically creates and encrypts VHDX-drives with BitLocker, I want to be able to use a Yubikey to unlock them. To add the Certificate I am using its thumbprint and the manage-bde command (manage-bde -protectors -add X: -certificate -ct THUMBPRINT), but for some reason I always get the same error Code 0x80310074. Do you have an idea on how this can be fixed?

Nathanael Frey says:

2024-09-30 at 17:36

Hi Valentin,

Are you able to complete step 8 using File Explorer? Looking at the Microsoft Documentation I see that it notes FVE_E_POLICY_USER_CERT_MUST_BE_HW, Group Policy requires that you supply a smart card to use BitLocker, as the error you note. To me this would suggest that one of the prior steps in the article may still need to be completed.

When you go to enable it through File Explorer or Control Panel you should receive a prompt for your YubiKey when selecting the smart card option.

Your command line looks good to me though, good idea.

Bill Bremer says:

2024-11-03 at 19:26

I tried your Bonus Step to Export / Import the certificate from one Yubikey to another with Yubikey Manager. The Export / Import went without error but when I try using the new Yubikey with Bitlocker it says it can’t find a smart card.

Doing an import of the .pfx file to the new Yubikey results in a Yubikey that works with Bitlocker.

Is there a trick to making the Yubikey Manager only method work?

Michael Campbell says:

2025-02-18 at 13:03

You mentioned “Yubico Authenticator app” can be used but I don’t see anywhere in your instructions on how to set that up with Bitlocker?????

Nathanael Frey says:

2025-03-09 at 12:35

As noted, the authenticator app is not required, just nice to have. Although it looks like more recent versions can manage certificate stuff too; haven’t tested but it could be a replacement for the manager app.

Michael Campbell says:

2025-02-19 at 11:13

I’m dual booting Linux and Windows. In Windows I followed your instructions in setting up Yubikey smart card certificate and was able to unlock the Bitlocker drive using the PIN nbr. In Linux, I couldn’t unlock the Bitlocker drive in Linux using the same PIN nbr from Windows/Bitlocker. I would have to add a password in Windows/Bitlocker to achieve this but I rather use the PIN. Is it possible to export the certificate in Linux to install it somewhere? Are there instructions for dual booting with Bitlocker?

Nathanael Frey says:

2025-03-09 at 12:36

How are you accessing BitLocker on Linux to begin with? I was not aware there was any form of support as this is a Windows technology.

Bill Bremer says:

2025-11-06 at 21:03

Now that the GUI version of YubiKey Manager is being discontinued, there may come a time when we can no longer use the Manager software to import directly from a pfx file into YubiKey Slot 9e.

I understand that openSSL allows conversion of a pfx file into two .pem files that can then be imported to YubiKey using the ykman CLI software.

Does anyone have any direct experience with this method or know of another method that works without YubiKey Manager?

Emanuele Ranucci says:

2026-03-07 at 13:35

“First of all, thank you for the tutorial! I followed all the steps, including the 2022-01-17 UPDATE and the BONUS section, because I want my second YubiKey (I have two YubiKey 5 NFCs, one with firmware 5.7 and one with 5.4) to be used as a smart card for all BitLocker-encrypted devices.

However, after completing all the steps, I’ve encountered a problem: when I attempt to unlock a BitLocker drive and the system prompts for the PIN of the second YubiKey, I receive the error ‘No valid Smartcard found’ immediately after entering the PIN.

It is worth noting that I am configuring this second YubiKey on the exact same device that I used to successfully configure the first one. Any advice on why the second key isn’t being recognized despite following the same procedure?”