Behavior When FileVault is Enabled

This section describes the authentication flow when turning on or restarting a Mac device where FileVault (macOS disk encryption) is enabled.

Authentication Flow

In an environment where FileVault is enabled, authentication is performed in the following order when the device is powered on or restarted.

1. Authentication for FileVault (Unlocking Disk Encryption)

When the device is turned on, an authentication screen is first displayed to unlock FileVault disk encryption.

  • This authentication is handled by the standard macOS mechanism and requires standard account name (username) and password authentication.
  • FIDO authentication using a security key cannot be used at this stage.

2. Logon Authentication with YubiOn FIDO Logon

Once FileVault is unlocked, the device proceeds to OS logon.

  • Default macOS Behavior:
    Logon authentication is normally skipped (the user is automatically logged on to the OS using the account name and password entered during FileVault authentication).
  • Behavior with YubiOn FIDO Logon Installed:
    The logon authentication is not skipped. Instead, the YubiOn FIDO Logon screen is displayed and FIDO authentication is required. You can log on to the Mac by authenticating with your security key as usual.