Configuring FIDO2 Redirection

When you enable WebAuthn redirection, the entire FIDO2 device does not need to be forwarded. For example, a YubiKey can continue to be used on the local endpoint while also being available in the remote session. For use cases that require full device access, consider using USB redirection instead.

The WebAuthn redirection code is installed automatically on supported client and agent machines.

To use FIDO2 devices in a nested mode setup, use USB redirection in the first hop and WebAuthn or USB redirection in the second hop. This mixed USB/FIDO2 redirection in nested mode does not support RDS hosts as the first hop.

You can collect logs on the client and agent using DCT. See Using DCT to Collect Logs for Remote Desktop Features and Components in the Horizon Administration guide.

Starting with Horizon 8 2609, FIDO2 redirection works in Microsoft Edge on Horizon Agent machines when the browser’s DynamicCodeSettings policy is enabled. Earlier Horizon Agent versions don’t support FIDO2 redirection while this policy is enabled. This support applies to FIDO2 redirection only. Other Horizon redirection features might still be affected when dynamic code execution is restricted in the browser.

System Requirements for FIDO2 Redirection

Using Group Policy Settings to Configure FIDO2 Redirection

You can configure WebAuthn redirection by editing the group policy settings. See View Agent Configuration ADMX Template Settings.