Identity and access · Checked 4 November 2026, 20:00 UTC.
Yubico released Authenticator 7.5.0 for desktop and Android on 3 November. Its PIV guide says PIN-derived configurations now block management-key operations, including certificate import. PIN-protected management keys remain supported.
Two configurations that can look similar
A user entering only a PIN does not reveal which management-key arrangement is underneath. In PIN-derived mode, software calculates the management key from the PIN and a salt. In PIN-protected mode, a management key is stored on the YubiKey in a data object whose contents require PIN verification to retrieve. Management-key authentication still happens. Yubico explains these mechanisms in its PIV PIN-only documentation.
The practical consequence is to identify the configuration before relying on the new app for enrollment or renewal. A familiar PIN prompt is insufficient evidence. Yubico's published Manager 5.9.0 PIV implementation distinguishes derived and stored keys in its information output. Treat that as a diagnostic reference, not proof that every management tool exposes the same labels.
Other changes worth putting in the rollout plan
The 7.5.0 release entry adds a Windows background service for FIDO operations without elevating the app to Administrator, replaces the desktop Python helper with a Rust helper, and raises the macOS minimum to Monterey 12.0. Those are concrete reasons to test deployment packaging and supported endpoints.
According to the user-guide release notes, temporary FIDO2, PIV and OATH credential caching now expires after three inactive minutes; the persistent read-only feature is unaffected. The notes also add ML-DSA and ML-KEM options for PIV work with a PQC-ready YubiKey. Record compatible hardware and software explicitly before evaluating those options.
A small acceptance test before broad deployment
The following is our proposed test plan. We reviewed the documentation; we did not install the release or test a YubiKey.
- Inventory the path. Record the OS, app package, device model, firmware, reader or connection, and provisioning tool. Establish which management-key mode each supported workflow uses. Keep PINs and key material out of the record.
- Separate use from administration. On a dedicated test key and account, check an existing sign-in separately from certificate import or renewal. A successful login cannot establish that the next administrative operation will work.
- Test the normal employee environment. On Windows, use the intended standard-user account and the organization's actual deployment policy. Verify service installation, operation after restart, and expected access. Do not assume that removing an app-elevation prompt makes every installation step unprivileged.
- Observe the session boundary. Compare behavior before and after more than three minutes of inactivity. Document whether persistent read-only access is enabled. Test that setting separately rather than expecting all credential views to behave identically.
- Make failure recoverable. Agree on a support route and a tested recovery procedure before changing production provisioning. Do not factory-reset a working key as a quick compatibility experiment: Yubico warns that a PIV reset removes its private keys and certificates.
Base rollout on tested configurations. This Authenticator management change does not establish that existing smart-card logins fail or that other clients dropped PIN-derived support.