Okta FIDO2 WebAuthn Login Fails Due to Missing YubiKey AAGUID in Allowlist

FIDO2 (WebAuthn) login fails when the authenticator configuration restricts access to specific Authenticator Attestation Globally Unique Identifiers (AAGUID) and the user's security key model is missing from the allowlist. Add the missing AAGUID to the FIDO2 (WebAuthn) authenticator configuration in the Okta Admin Console to resolve this issue. The System Log displays the following error:

AllowList is setup that does not allow this factor's aaguid.

• Okta Identity Engine (OIE)
• Multi-Factor Authentication (MFA)
• FIDO2 (WebAuthn)
• Security Keys

This issue occurs when administrators configure the FIDO2 (WebAuthn) authenticator with an allowlist that explicitly defines permitted security key models. Okta rejects the authentication attempt if a user attempts to use a security key with an AAGUID missing from this list. This commonly happens when users acquire newer key models, such as newer firmware versions of YubiKeys, that possess different AAGUIDs than the older models already present on the allowlist.

How is the missing AAGUID added to the allowlist?

Identify the missing AAGUID from the System Log and add it to the FIDO2 (WebAuthn) authenticator configuration in the Okta Admin Console by following these steps.

1. Identify the missing AAGUID from the System Log.
2. Navigate to Security > Authenticators in the Okta Admin Console.
3. Locate the FIDO2 (WebAuthn) authenticator and select Actions > Edit.
4. Scroll to the Allowed AAGUIDs configuration section.
5. Select Add Authenticator.
6. Enter the AAGUID retrieved from the System Log.
7. Enter a description for the key in the description field.
8. Select Save.
9. Instruct the user to retry the login to verify successful authentication without requiring re-enrollment.