How can Bluetooth be restricted to passkey authentication only?
Asked by
MellowCedar47
We want users to authenticate to Microsoft 365 with passkeys stored on their phones, using Bluetooth for the cross-device authentication step. Windows Hello for Business is not acceptable in our environment because of regulatory and audit requirements, so Bluetooth is currently the only practical option. At the same time, users should not be able to pair or connect ordinary Bluetooth peripherals to their workstations. We use Sophos EDR, but its Bluetooth blocking controls have been inconsistent. Is there a reliable Windows policy or management approach that allows Bluetooth passkey authentication while preventing general Bluetooth device connections?
Answers
If the requirement is strong enough to disable ordinary Bluetooth, issuing FIDO2 security keys may be easier to defend and operate than trying to make the Bluetooth stack support one narrowly defined use case. It costs more and users can lose the keys, but it avoids exposing a broader Bluetooth attack surface.
Reply to this answer
Microsoft has a policy specifically for Bluetooth-restricted environments. It can allow the proximity-based Bluetooth connection used for cross-device passkey authentication while preventing normal Bluetooth devices from pairing. This is generally the direction I would investigate through Intune or the relevant Windows MDM policy rather than relying only on endpoint security software.
Reply to this answer
A less complete control is to block Bluetooth file transfer, such as preventing the Windows Bluetooth file-transfer utility from running. That stops one obvious use case, but it does not prevent pairing or address vulnerabilities in the Bluetooth stack, so it should not be treated as equivalent to restricting Bluetooth connections.
Reply to this answer
The reason for the restriction should drive the design. If it is an audit requirement, document the accepted risk and test the exact Windows policy in your environment, including passkey authentication, audio devices, keyboards, and file transfer. If the policy cannot reliably separate those functions, dedicated security keys are likely the cleaner compensating control.
Reply to this answer
Be careful to distinguish passkeys stored on dedicated security keys from cross-device authentication. A hardware key may use NFC or USB, while using a phone's passkey on a workstation relies on Bluetooth as part of the hybrid transport. The Microsoft passkey guidance covers this restricted-Bluetooth scenario.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions