How to Completely Disable ‘Web Authentication’ (WebAuthn) via Group Policy in Microsoft Edge

The Web Authentication API (WebAuthn) is a modern, W3C-standardized interface built into Microsoft Edge that enables secure, passwordless authentication using public-key cryptography. It allows websites to interact with physical security keys (like YubiKeys) or platform authenticators (like Windows Hello) for robust user verification. While highly recommended for modern identity architectures, WebAuthn can become a significant operational security (OPSEC) liability in specific, highly constrained zero-trust environments or legacy enclaves where all authentication MUST be routed exclusively through a centralized, on-premises Identity Provider (IdP) using Kerberos or specialized smart card middleware (e.g., DoD CAC/PIV). In these hyper-specific scenarios, allowing the browser to negotiate WebAuthn directly with external, untrusted web services circumvents localized authentication tracking and introduces an unauthorized vector for identity federation.

This guide explains how to completely disable ‘Web Authentication’ (WebAuthn) via Group Policy in Microsoft Edge, enforcing a strict zero-trust model where the browser is cryptographically prevented from interacting with physical or biometric authenticators for web logins.

Disable Web Authentication (WebAuthn) via Group Policy

To enforce a strict block that permanently neutralizes the WebAuthn API within the browser rendering engine, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge

5. In the right-hand pane, locate the policy named Enable Web Authentication API (or in some newer templates, Allow the Web Authentication API).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (By explicitly disabling this policy, we instruct the Edge rendering engine to completely disable the navigator.credentials.create() and navigator.credentials.get() JavaScript APIs specifically for public key credentials, permanently severing the browser’s ability to communicate with the Windows WebAuthn broker).
8. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes require the browser to read the registry upon its next launch.

Close all active instances of Microsoft Edge. To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, launch Microsoft Edge and navigate to a known WebAuthn testing site (such as webauthn.io). Attempt to register a new authenticator. The website will immediately return a JavaScript error or state that the browser does not support the Web Authentication API. The browser will completely fail to invoke the Windows Hello security prompt. The browser is now cryptographically bound to a strict, non-WebAuthn state, forcing reliance on alternative, approved authentication mechanisms.