Appterix
Menu
Skip to main content
How can we help?
Table of Contents
<All topics
Print

Secure revocation of AD certificates and Entra ID passkeys with Appterix YubiKey Management

Hardware security keys like the YubiKey offer the highest level of protection against phishing and unauthorized access. However, the security of hardware-based authentication depends entirely on efficient lifecycle management – ​​especially when a key is lost, stolen, or an employee leaves the company.

The Appterix YubiKey LifeCycle Management This provides a central platform for this. This article highlights best practices, concrete solution scenarios, and the enormous added value of centrally revoking Active Directory (AD) certificates and Microsoft Entra ID passkeys.

The added value of centralized management with Appterix

Without a central management tool, revoking login credentials on physical tokens is often a fragmented and time-consuming process. Appterix solves this problem by offering the following added value:

  • Single Pane of Glass: Administrators can see at a glance (in the area Inventory > Registered login information), which certificates and FIDO2 passkeys are stored on which physical YubiKey.
  • Fast reaction time (MTTR): In an emergency (e.g. loss), login credentials can be revoked across systems with just a few clicks, without administrators having to switch between AD CS consoles and the Entra ID portal.
  • Audit security (compliance): Appterix meticulously logs every cancellation. It records, which one Administrator when and from for what reason A login credential has been revoked. The status will permanently change to "Revoked".
  • Granular control: It's not necessary to render the entire YubiKey unusable. Appterix allows for the targeted revocation of individual certificates or passkeys, while other YubiKey functions remain intact.

Practical solution scenarios

Scenario A: The lost YubiKey

An employee reports his YubiKey as lost.

  • Action: The administrator searches for the YubiKey in the Appterix inventory, marks the physical key as "Lost" (tag) or "Locked" and navigates to the tab. Registered login information.
  • Solution: All listed AD certificates and Entra ID passkeys will be revoked immediately. Even if a finder knows the key's PIN, authentication at the backend (Entra ID / AD) will be rejected by the identity provider.

Scenario B: Offboarding an employee

An employee is leaving the company but returning their YubiKey. The security key is to be "recycled" for a new employee.

  • Action: Before the physical reset (PIV/FIDO reset) of the key via the Appterix agent, IT support goes to the Appterix management UI.
  • Solution: To ensure that no orphaned authentication methods remain in Entra ID or Active Directory, the departing employee's registered passkeys and certificates are revoked via Appterix. The identity system remains "clean".

Scenario C: Suspected compromise

An employee clicks on a suspicious link; there is a suspicion that his session or computer has been compromised.

  • Action: Preventive revocation of current registration information.
  • Solution: The administrator revokes the currently valid AD certificate via Appterix. The employee is then prompted to perform an "enrollment step" via the Appterix agent to load a fresh, secure certificate onto the YubiKey.

Recommended action: How to revoke login information in Appterix

To effectively and securely revoke login credentials, follow this best-practice workflow in the Appterix Management UI:

  1. Check prerequisites: Make sure the FIDO2 synchronization for the relevant YubiKey, so that Appterix knows the current status of the passkeys from Entra ID.
  2. Locate YubiKey: Navigate to YubiKey Management > Inventar and select the YubiKey of the affected user.
  3. View login information: Switch to the tab Registrierte Anmeldeinformationen.
  4. Initiate a revocation: Locate the specific AD certificate or Entra ID Passkey (FIDO2) in the table and click on it in the row. Widerrufen.
  5. State the reason (Important for audits!): A confirmation dialog will open. Enter here eternity provide a meaningful reason (e.g., "Token lost on May 15.05th" or "Offboarding User XY").
  6. To confirm: Complete the process. The login information will receive the status Widerrufen and cannot be recovered for this token.

Attention: The revocation is permanent. A revoked certificate or a deleted passkey cannot be reactivated, but must be redeployed if necessary.

4. Backend prerequisites: Permissions in AD and Entra ID

In order for Appterix to revoke login credentials not only in its own database but also in your identity systems, the Appterix service account (or the connected enterprise app) requires specific permissions in your backend systems.

Active Directory Certificate Services (AD CS)

When Appterix revokes a certificate, it must communicate with the Certification Authority (CA) to place the certificate on the Certificate Revocation List (CRL).

  • Required authorization: The service account that Appterix uses for communication with AD CS requires the right "Issue and Manage Certificates" at the relevant certification body.
  • Configuration: Open the Certification Authority MMC (certsrv.msc) -> Right-click on the CA -> Features -> Rider Safety -> Add the Appterix service account and check the box for "Issue and manage certificates".

Microsoft Entra ID (formerly Azure AD)

To delete (revoke) FIDO2 passkeys for a user, Appterix interacts with your Entra ID tenant via the Microsoft Graph API.

  • Required API permissions (Microsoft Graph): The app registered for Appterix in Entra ID requires application permissions to edit user authentication methods.
    • UserAuthenticationMethod.ReadWrite.All (This allows Appterix to read and delete FIDO2 methods for all users).
  • Required Entra ID role: Alternatively/Additionally (depending on the type of integration), the Service Principal requires the role “Authentication Policy Administrator” or “Privileged Authentication Administrator” to be able to manage passkeys for users.
  • Configuration: Check the Entra ID Portal under App registrations > [Appterix App] > API permissions, that the aforementioned Graph API rights have been granted and approved by an admin (Admin Consent).

Published
Updated
FromEgoMind