Configuring FIDO2 Redirection

When you enable WebAuthn redirection, the entire FIDO2 device does not need to be forwarded. For example, a YubiKey can continue to be used on the local endpoint while also being available in the remote session. For use cases that require full device access, consider using USB redirection instead.

The WebAuthn redirection code is installed automatically on supported client and agent machines.

To use FIDO2 devices in a nested mode setup, use USB redirection in the first hop and WebAuthn or USB redirection in the second hop. This mixed USB/FIDO2 redirection in nested mode does not support RDS hosts as the first hop.

You can collect logs on the client and agent using DCT. See Using DCT to Collect Logs for Remote Desktop Features and Components in the Horizon Administration guide.

Note: Horizon WebAuthn Redirection may not work with UWP-based Windows applications such as Microsoft Teams, Outlook for Office 365, and OneDrive, which use UWP for authentication. As a workaround, use Horizon USB redirection for VDI desktops. No workaround is currently available for RDSH.

Note: FIDO2 redirection is currently not supported on the Horizon Web Client and the Horizon Client for Chrome.

System Requirements for FIDO2 Redirection

Using Group Policy Settings to Configure FIDO2 Redirection

You can configure WebAuthn redirection by editing the group policy settings. See View Agent Configuration ADMX Template Settings.