Passkeys (FIDO2) Authentication Method in Microsoft Entra ID

Passkeys (FIDO2) — Definition

Passkeys are modern, phishing-resistant authentication credentials based on the FIDO2 standard that replace passwords with cryptographic key pairs. A passkey consists of a private key kept on a user's device and a public key stored by the service. When signing in, the service challenges the device to prove possession of the private key, enabling secure, passwordless authentication.

Short Explanation

FIDO2 passkeys simplify and strengthen authentication by eliminating shared secrets (passwords) and using public-key cryptography. They are tied to the user's device and protected by device unlock methods such as biometrics (fingerprint, facial recognition) or a local PIN. Because authentication relies on cryptographic assertions rather than user-entered passwords, passkeys are resistant to phishing, replay attacks, and credential stuffing. Solutions like Microsoft Entra support passkeys to enable seamless, secure sign-ins across web and mobile apps while allowing key synchronization across devices through trusted cloud platform features when desired.

In the evolving landscape of digital security, robust authentication methods are paramount to safeguarding organizational assets and user identities. This article delves into the implementation and benefits of passkeys, specifically FIDO2 authentication, within Microsoft Entra ID. We will explore what passkeys are, how FIDO2 functions, and the tangible advantages they offer in enhancing security posture and streamlining the user sign-in experience.

Microsoft Entra Passkeys — 9 Surprising Facts about Passkeys (FIDO2)

• Passkeys are not just "strong passwords": they use public-key cryptography so the server stores only a public key — the private key never leaves your device.
• They are inherently phishing‑resistant: WebAuthn/FIDO2 binds credentials to a site's origin, so a fake site cannot obtain usable authentication data.
• Passkeys can sync across your devices via platform cloud backup (Apple iCloud Keychain, Google Password Manager, Microsoft account), enabling recovery — but that introduces a new trust surface with the cloud provider.
• You can have multiple passkeys per account and per device; creating several passkeys is recommended for backup and cross‑device access rather than relying on one credential.
• Passkeys work with biometric verification or device PINs but do not transmit biometric data — the device verifies you locally and signs challenges with the private key.
• They support both platform authenticators (built into phones/laptops) and roaming authenticators (USB/NFC security keys), which makes cross‑platform strategies possible for Microsoft Entra passkeys deployments.
• Passkey attestation can reveal device model information to relying parties unless anonymizing attestation is used — privacy choices matter during implementation.
• Migrating users away from passwords can reduce account takeover drastically, but organizations still need fallback flows (account recovery, alternate authenticators) to avoid lockouts when devices are lost.
• Adopting passkeys helps meet regulatory and security frameworks: FIDO2 authentication is recognized as phishing‑resistant strong authentication and can simplify compliance when integrated into Microsoft Entra ID/Entra.

Understanding Passkeys and FIDO2

What are Passkeys?

Passkeys represent a revolutionary shift in authentication technology, designed to provide a more secure and user-friendly alternative to traditional passwords. At their core, passkeys are cryptographic credentials that allow users to sign in to websites and applications without the need for a memorable string of characters. Instead, the authentication process leverages public-key cryptography, where a unique pair of cryptographic keys is generated for each online account. One key, the public key, is stored with the service provider (e.g., Microsoft Entra ID), while the other, the private key, remains securely on the user's device or within a secure authenticator. When a user attempts to sign in, the service challenges the device to prove possession of the private key, a process that is cryptographically verified without ever transmitting the private key itself. This inherent design makes passkeys significantly more resistant to phishing and other credential-based attacks, elevating the standard of digital identity protection. Users can register a passkey on various devices, from smartphones to dedicated FIDO2 security keys, creating a flexible and resilient authentication method.

Overview of FIDO2 Authentication

FIDO2 authentication is the foundational open standard that underpins the concept of passkeys. Developed by the FIDO Alliance in collaboration with the World Wide Web Consortium (W3C), FIDO2 defines a set of protocols that enable strong, phishing-resistant authentication across the web. This standard leverages WebAuthn, a web API, and CTAP2, a client-to-authenticator protocol, to facilitate secure communication between a user's device (the authenticator) and the online service. When an organization decides to enable passkeys within Microsoft Entra ID, they are essentially enabling FIDO2 authentication. This allows users to register a passkey from a FIDO2 security key or a device acting as an authenticator. The process involves the user creating a passkey, which then becomes a primary authentication method or a robust component of multifactor authentication. The architecture ensures that private keys never leave the authenticator, providing a formidable barrier against common cyber threats and setting a new benchmark for authentication security. Microsoft Entra ID fully supports FIDO2, allowing administrators to enable passkeys as a robust sign-in option.

Benefits of Using Passkeys

The adoption of passkeys within Microsoft Entra ID brings a multitude of compelling benefits, primarily centering on enhanced security and improved user experience. This transition signifies a proactive step towards a passwordless future, offering a practical and effective solution for modern identity management. Organizations can also implement passkeys as a robust multifactor authentication factor, strengthening their overall security posture. The ability to register passkeys directly within Microsoft Entra ID, often through the Microsoft Authenticator app or a dedicated FIDO2 security key, simplifies deployment and management for Entra admins.

Microsoft Entra Passkeys: Pros and Cons

Pros

• Phishing-resistant authentication: Passkeys use public-key cryptography tied to the device, preventing credential theft via phishing.
• Easy user experience: Sign-in often uses platform biometrics or PIN, simplifying login flows compared to passwords.
• Cross-device syncing: Many implementations (including those integrated with services like Microsoft Entra Passkeys) can sync credentials across a user’s devices for convenience.
• Reduced password management overhead: Eliminates need to create, remember, or reset passwords, lowering support costs and friction.
• Strong privacy: Only the relying party’s origin is revealed to the authenticator; credentials aren’t reusable across sites.
• Backward-compatible transition: Can be adopted alongside existing authentication methods, enabling staged rollout.

Cons

• Device dependency and recovery complexity: If a user loses all devices or access to sync, account recovery can be more complex than password resets.
• Variable cross-platform support: While improving, not all browsers, platforms, or services fully support passkey flows equally.
• Implementation complexity: Proper integration with account lifecycle, recovery, and multi-device provisioning requires careful design and development.
• Enterprise policy and compliance: Organizations may need to update identity governance, device management, and compliance policies to adopt passkeys broadly.
• User education required: Some users may be unfamiliar with the concept and need guidance on device usage and recovery options.

FIDO2: Pros and Cons

Pros

• Strong cryptographic authentication: FIDO2 provides public-key credential-based authentication that is inherently resistant to phishing and replay attacks.
• Standards-based and interoperable: Widely supported by major platforms, browsers, and security keys, enabling broad ecosystem compatibility.
• Flexibility of authenticators: Supports platform authenticators (built into devices) and roaming authenticators (security keys), offering deployment choices.
• Improved security posture: Reduces reliance on passwords and mitigates credential database breaches since servers store only public keys.
• Enterprise readiness: FIDO2 can integrate with enterprise identity providers and can be combined with solutions like Microsoft Entra to enforce stronger authentication policies.

Cons

• Deployment and integration effort: Integrating FIDO2 into existing systems, single sign-on, and legacy applications can require substantial development and testing.
• User device and hardware requirements: Some users may need to purchase roaming keys or require compatible devices to use platform authenticators.
• Account recovery challenges: Establishing secure, user-friendly recovery processes without reintroducing weak authentication vectors is difficult.
• Operational overhead: Managing hardware tokens, provisioning, lost-token handling, and lifecycle policies adds operational tasks for IT.
• Fragmented user experience: Differences in how browsers and platforms implement UI for FIDO2 flows can lead to inconsistent user experiences across devices.

Setting Up Passkeys in Microsoft Entra ID

How to Register a Passkey

To register a passkey in Microsoft Entra ID, users can leverage various methods, with the Microsoft Authenticator app being a primary option for synced passkeys. The process typically begins by navigating to the user's security info page or through specific prompts during a sign-in attempt. Once initiated, the user will be guided to create a passkey, which often involves biometric verification or a PIN on their device. This action securely generates the cryptographic key pair; the public key is registered with Microsoft Entra ID, while the private key remains on the user's device or within a secure passkey provider. For those utilizing FIDO2 security keys, the registration process involves connecting the physical key and following the on-screen instructions to establish the passkey profile. Entra admins can oversee passkey registration policies, ensuring that users can easily register passkeys and enhance their phishing-resistant authentication capabilities.

Enabling Passkeys in Authenticator

Enabling passkeys in Microsoft Authenticator is a crucial step for organizations aiming to provide a seamless and secure sign-in experience. Entra admins can configure policies within the Microsoft Entra admin center to allow users to register a synced passkey directly through the Authenticator app. This involves navigating to the authentication methods blade, where specific settings for FIDO2 and passkeys can be managed. Once enabled, users will see the option to create a passkey within their Authenticator app settings, typically under the 'Security info' section. This allows them to register a synced passkey that can then be used across multiple devices for sign-in to Microsoft Entra applications, significantly bolstering multifactor authentication strategies and moving closer to a passwordless future, as highlighted by Microsoft Learn resources.

Making Passkeys the Default Authentication Method

For organizations committed to strengthening their security posture and embracing a truly passwordless environment, making passkeys the default authentication method in Microsoft Entra ID is the ultimate goal. Entra admins, or individuals with the Authentication Policy Administrator role, can configure authentication policies to prioritize passkeys over traditional passwords. This involves setting passkeys as the preferred method in the Microsoft Entra admin center, ensuring that users are prompted to use the passkey for sign-in whenever possible. While a phased approach might be necessary to ensure user readiness, the ability to make passkeys the default authentication method significantly enhances phishing-resistant authentication, reduces reliance on less secure methods, and streamlines the user experience. This strategic shift underscores the ongoing security updates and advancements in Microsoft Entra ID towards a more secure and efficient identity management ecosystem.

Checklist: Setting Up Microsoft Entra Passkeys

Use this checklist to plan, deploy, and validate passkeys in Microsoft Entra ID (Microsoft Entra Passkeys).

Prerequisites

• Confirm Azure AD / Microsoft Entra ID tenant is active and you have Global Administrator or Identity Administrator privileges.
• Verify subscription and licensing support for passwordless authentication and FIDO2/passkey features.
• Ensure devices and browsers used by users support passkeys/FIDO2 (modern Windows, macOS, iOS, Android, and Chromium-based browsers).
• Confirm organization has a documented passwordless adoption plan and communication strategy.

Prepare Microsoft Entra ID

• Navigate to Microsoft Entra admin center and locate Authentication methods > Policies.
• Enable the Passkey (FIDO2) authentication method and set it to Allowed or Required for targeted users or groups.
• Configure user and device restrictions (trust anchors, platform authenticator vs roaming authenticator) as needed.
• Review legacy authentication policies to reduce conflicts and ensure passwordless flows are prioritized.

Configure Conditional Access and Security Settings

• Update Conditional Access policies to allow or require passwordless sign-in where appropriate.
• Add risk-based access controls (Azure AD Identity Protection) alongside passkey rollouts.
• Test policies in Report-only mode before enforcing.

User Onboarding and Registration

• Create step-by-step user guidance for registering passkeys (enrollment via Windows Hello, platform/browser prompts, or external security keys).
• Provide screenshots and known-device instructions for common platforms (Windows, macOS, iOS, Android).
• Define policy for multiple passkeys per user and backup/recovery process.
• Pilot with a small user group and collect feedback.

Testing and Validation

• Verify successful registration and sign-in for pilot users across supported platforms and browsers.
• Test SSO scenarios, MFA prompts, and Conditional Access behavior with passkeys.
• Confirm fallback sign-in methods (secondary MFA, account recovery) are functional and secure.
• Monitor sign-in logs and Authentication methods usage reports in Microsoft Entra.

Rollout and Training

• Communicate rollout schedule, benefits, and support resources to users.
• Provide IT support teams with runbooks for common enrollment and failure scenarios.
• Enforce policies in phases, expanding from pilot groups to entire organization.

Monitoring and Maintenance

• Regularly review Microsoft Entra sign-in logs and authentication method reports for anomalies.
• Track adoption metrics and user support tickets related to passkeys.
• Keep documentation updated for OS/browser changes affecting passkey behavior.
• Periodically review and update Conditional Access and authentication method policies.

Troubleshooting and Rollback

• Document common errors (device compatibility, browser prompts, registration failures) and resolutions.
• Provide clear account recovery and emergency access processes for users who lose access to passkeys.
• If critical issues occur, be prepared to revert authentication method enforcement and communicate rollback steps.

Security and Compliance Considerations

• Ensure passkey deployment aligns with organizational security policies and compliance requirements.
• Validate that passkey storage and attestation methods meet enterprise standards.
• Review third-party authenticator and device vendor security guidance.

Completion of this checklist will help ensure a successful, secure adoption of Microsoft Entra Passkeys across your organization.

Types of Passkeys and Their Features

Exploring Synced Passkeys

Synced passkeys represent a significant leap forward in user convenience and accessibility within the passkey ecosystem, particularly within Microsoft Entra ID. These passkeys are designed to synchronize across a user's various devices, offering a seamless sign-in experience without compromising the robust security of FIDO2 authentication. When a user creates a passkey on one device, it can be securely replicated to other authenticated devices via a secure passkey provider, often integrated directly into the operating system or a dedicated password manager. For instance, enabling synced passkeys through the Microsoft Authenticator app allows a user to register a passkey once and then use the passkey to sign in to Microsoft Entra ID from their phone, tablet, or PC, provided the devices are linked to the same account. This capability greatly enhances the practicality of passkeys as a default authentication method, moving organizations closer to a truly passwordless future by ensuring users always have access to their phishing-resistant authentication credentials.

Different Types of Passkeys Available

Beyond synced passkeys, it is crucial for Entra admins to understand the various forms a passkey can take to effectively manage authentication methods in Microsoft Entra ID. The primary distinction lies between synced passkeys and device-bound passkeys. Both types leverage the FIDO2 standard for phishing-resistant authentication, but their deployment and management strategies differ. Organizations may choose to enable synced passkeys for general user convenience, while requiring device-bound passkeys for highly privileged accounts or specific compliance requirements, thereby creating a flexible and robust authentication strategy. This comprehensive approach ensures that the organization can register passkeys that align with diverse security needs and user preferences.

Using FIDO2 Security Keys

FIDO2 security keys offer a highly secure and distinct method for using passkeys, acting as dedicated hardware authenticators for FIDO2 authentication in Microsoft Entra ID. These physical devices, typically small USB tokens, generate and store the private key securely within their tamper-resistant hardware. When a user needs to sign in to Microsoft Entra ID, they simply insert the FIDO2 security key and follow the prompts, often involving a PIN or biometric verification directly on the key.

This provides an additional layer of security, as the private key never leaves the hardware, making it immune to many software-based attacks. Entra admins can enable passkeys specifically through FIDO2 security keys, offering a robust multifactor authentication option that is highly recommended for critical roles or environments where maximum security is paramount. The process to register a passkey with a FIDO2 security key is straightforward, empowering users with a powerful phishing-resistant authentication method.

Common Mistakes People Make About FIDO2 Security Keys

FIDO2 security keys are strong authentication tools often used with platforms like Microsoft Entra Passkeys. Below are common mistakes people make and how to avoid them.

• Assuming a key is a complete replacement for account recovery: Many think a FIDO2 key alone covers all recovery scenarios. If you lose the key and haven't enabled alternate recovery methods (backup keys, recovery codes, or platform-managed passkeys like Microsoft Entra Passkeys), you can be locked out.
• Not registering backup keys or methods: Registering only one security key is risky. Always add at least one backup key and enable secondary recovery options to prevent account loss.
• Confusing FIDO2 keys with hardware OTP tokens: FIDO2 keys use public-key cryptography and are phishing-resistant, unlike many one-time-password (OTP) tokens. Treat them differently in workflows and documentation.
• Expecting universal plug-and-play without checking compatibility: Not all sites or platforms support every FIDO2 feature. Verify browser, platform, and service support—especially when integrating with identity services such as Microsoft Entra Passkeys.
• Using insecure storage or labeling of backup keys: Storing a backup key in an obvious place or marked “security key” compromises security. Keep spares in secure, discreet locations.
• Neglecting firmware updates and vendor guidance: Some keys receive updates or have known issues. Ignore vendor advisories at your peril—follow recommended maintenance and replacement windows.
• Sharing a single key across multiple users: Keys are typically tied to a single user identity. Sharing a key undermines individual accountability and may break audit and compliance requirements.
• Misunderstanding resident keys vs. non-resident keys: Resident (discoverable) credentials are stored on the key; non-resident credentials rely on the server. Choosing the wrong type for your use case can affect portability and recovery options.
• Assuming physical possession equals unrestricted access: A stolen key may still be protected by PIN or biometric on the device, but assuming it’s safe without enabling those protections is a mistake—always enable available PIN/biometric and consider device lock policies.
• Neglecting user education and operational processes: Deploying keys without training leads to misuse, lost keys, or support burden. Provide clear onboarding, lost-key procedures, and integration tips (for example, using Microsoft Entra Passkeys to streamline user experience).

Using Entra Passkeys on Windows

Integrating Passkeys with Windows Hello for Business

Integrating Entra passkeys with Windows Hello for Business offers a powerful synergy for enhancing security and streamlining the sign-in experience on Windows devices. When an organization decides to enable passkeys in Microsoft Entra ID, particularly through Windows Hello for Business, users gain access to device-bound passkeys that leverage the robust biometric or PIN authentication already integrated into their Windows environment. This means that to use the passkey for sign-in, users simply authenticate with their familiar Windows Hello method, such as a fingerprint, facial recognition, or a PIN. This integration provides a seamless and highly phishing-resistant authentication method, as the private key for the passkey never leaves the device and is protected by the secure hardware of Windows Hello for Business. Entra admins can configure policies to allow this integration, making it straightforward for users to register a passkey and experience a truly passwordless future directly from their Windows devices.

Accessing Entra Passkeys on Windows

Accessing Entra passkeys on Windows devices is designed to be a straightforward and secure process, whether through synced passkeys or device-bound passkeys via Windows Hello for Business. For synced passkeys, users who have enabled passkeys in Microsoft Authenticator or another passkey provider will find their passkey profile readily available on their Windows device, allowing them to sign in to Microsoft Entra applications with ease. When prompted for authentication, Windows will offer the option to use the passkey, often requiring a simple confirmation or biometric verification. For those utilizing Windows Hello for Business, the access is even more integrated, as the passkey is directly tied to the device's secure element. This enables users to sign in to Microsoft Entra ID and other services by simply authenticating with Windows Hello, providing a consistent and highly secure sign-in experience across their Windows ecosystem, significantly enhancing their phishing-resistant authentication capabilities.

Security Updates and Best Practices

To maintain the highest level of security and ensure optimal functionality when using Entra passkeys on Windows, adherence to security updates and best practices is crucial. Entra admins should prioritize keeping Windows operating systems, the Microsoft Authenticator app, and any FIDO2 security key firmware up to date to benefit from the latest security enhancements and bug fixes. Regularly reviewing and updating authentication policies in the Microsoft Entra admin center helps ensure that passkey registration and usage align with organizational security requirements. Educating users on how to create a passkey securely, understanding the differences between synced passkeys and device-bound passkeys, and the importance of protecting their devices are also vital. Microsoft Learn provides extensive resources on these security updates and best practices, guiding organizations toward a resilient and passwordless authentication strategy within their Microsoft Entra ID environment.

Troubleshooting and Support

Common Issues with Passkeys

When deploying and managing passkeys in Microsoft Entra ID, Entra admins and users may encounter a few common issues that require troubleshooting. One frequent challenge is ensuring that users can successfully register a passkey, particularly if device compatibility or policy configurations are not correctly aligned. Users might experience difficulties if their FIDO2 security key is not recognized or if there are conflicts with existing authentication methods. Another common issue relates to synced passkeys not synchronizing across all intended devices, often due to connectivity problems or incorrect passkey provider settings. Additionally, users might inadvertently delete their passkey profile or face challenges when attempting to make passkeys the default authentication method if fallback options are not properly configured. Understanding these potential hurdles is the first step towards effectively addressing them and maintaining a smooth passwordless experience.

How to Enable and Target Passkeys

Enabling and effectively targeting passkeys in Microsoft Entra ID is a critical administrative task that requires careful configuration within the Microsoft Entra admin center. Entra admins, or those with the Authentication Policy Administrator role, must navigate to the authentication methods blade to enable passkeys for their organization. This involves selecting FIDO2 Security Key or allowing users to register a synced passkey through the Microsoft Authenticator app. Targeting specific user groups for passkey deployment is a best practice, allowing for a phased rollout and ensuring that the appropriate users can create a passkey. This can be achieved by assigning policies to specific user groups, ensuring that only authorized individuals can register passkeys and use the passkey as a primary or multifactor authentication method. Proper targeting helps manage the transition to a passwordless environment and aligns with organizational security updates.

Getting Help with Passkey Setup

For Entra admins and users requiring assistance with passkey setup, a variety of resources are available to ensure a smooth transition to this phishing-resistant authentication method. Microsoft Learn offers comprehensive documentation and tutorials that detail every step of the process, from how to enable passkeys in Microsoft Entra ID to troubleshooting common issues. The Microsoft Entra admin center provides in-context help and guides for configuring authentication policies and managing passkey registration. Additionally, Microsoft support channels are available for more complex issues, offering expert assistance for setting up and maintaining passkeys in Microsoft Entra. Leveraging these resources can help organizations overcome challenges, effectively enable synced passkeys, and successfully make passkeys the default authentication method, thereby significantly bolstering their security posture and embracing a modern, passwordless sign-in experience.

FAQ

passkey profile: creating and manage a passkey profile

entra passkey on windows: enable and use entra passkey on windows devices

passkeys work: how passkeys work across devices and synced passkeys

What is a Microsoft Entra passkey and how does it differ from FIDO2 passkey?

A Microsoft Entra passkey is a modern, phishing-resistant credential stored either on a device or in a cloud passkey provider and managed through Microsoft Entra ID; it uses public-key cryptography similar to a FIDO2 passkey but is integrated with Microsoft 365 and Entra features to enable passkey sign-in and cloud-based sync across devices.

How do I enable passkey sign-in for my organization?

To enable passkey sign-in you must create a passkey profile in Microsoft Entra, configure passkey profiles to specify policy (including whether users can use synced passkeys), and optionally integrate with Microsoft Intune to enforce device controls; administrators choose whether passkeys will become the default authentication experience or remain optional.

What does "want to allow synced passkeys" mean and how do I configure it?

"Want to allow synced passkeys" is a policy decision that lets users store passkeys in a cloud passkey provider so they can use synced passkeys across devices; configure this by enabling the option in the passkey profile and ensuring users are prompted to register a passkey and that the cloud passkey provider is supported.

Can users register a passkey directly or are they prompted to register a passkey?

Users can register a passkey directly through account security settings in their Microsoft Entra account or they can be prompted to register a passkey during sign-in flows when the organization enforces passkeys as the default authentication experience or when the passkey profile triggers a registration prompt.

How do passkeys work on Windows and does Microsoft Entra support Windows Hello?

Passkeys work on Windows by leveraging Windows Hello as an authenticator; when using entra passkey on windows, the device can generate a bound passkey stored in the TPM or in a cloud passkey provider and Microsoft Entra ID supports using Windows Hello to create and use authenticator passkeys.

What are bound passkeys and where are passkeys stored?

Bound passkeys are passkeys tied to a specific device's authenticator (like Windows Hello) and are typically stored in hardware-backed secure storage (TPM). Synced passkeys or cloud-stored passkeys are stored in the cloud passkey provider associated with the user’s Microsoft Entra account.

How do I create a passkey profile and can it be scoped for multiple policies?

You create a passkey profile in the Microsoft Entra portal by selecting authentication methods and settings; passkey profiles can be scoped for multiple groups or environments, and you can create scoped passkey profiles or three passkey profiles to apply different rules across user populations.

What should I do if users can't register a passkey?

If users can't register a passkey, verify that the passkey profile to enable registration is assigned to their account, check that their devices meet requirements (e.g., Windows Hello or a compatible authenticator), confirm the cloud passkey provider and Microsoft Entra ID settings allow register the passkey directly, and ensure any Microsoft Intune device configuration policies are not blocking authenticator features.

Will passkeys become the default authentication experience in Microsoft Entra?

Microsoft has signaled that passkeys will become the default authentication experience for many users; administrators can proactively configure passkeys as the default authentication by setting passkeys as the primary method in the passkey profile so passkeys as the default authentication takes effect per organization policy.

How do synced passkeys in Microsoft Entra work with multiple devices and Microsoft 365 apps?

Using synced passkeys allows a user's passkeys to be synchronized via a cloud passkey provider so they can sign in on multiple devices; when using Microsoft 365 apps, the passkey sign-in is handled by Microsoft Entra ID and the cloud provider, letting users use passkeys for Microsoft 365 without re-registering on each device.

Can I enforce passkey use and how granular can the policy be?

Yes, you can enforce passkey use by configuring policies in passkey profiles and conditional access in Microsoft Entra ID; policies can be granular—scoped passkey profiles let you enforce passkeys for specific users, groups, or scenarios and even restrict which authenticators or cloud passkey providers are allowed.

What is the difference between client to authenticator protocol and passkey sign-in?

The client to authenticator protocol (CTAP) is a technical protocol used by authenticators to communicate with clients (browsers/devices), whereas passkey sign-in is the end-user process of authenticating with a passkey; CTAP underlies FIDO2 passkey and authenticator passkeys used during passkey sign-in flows.

How do I see passkeys and manage them for users in Microsoft Entra?

Administrators can view passkey registration status and manage passkeys via Microsoft Entra ID's authentication methods and reports; users can see passkeys in their Microsoft Entra account security settings where they can register the passkey or remove a passkey that is stored either on the device or in the cloud provider.

Are passkeys supported by Microsoft Entra ID and what authenticators are compatible?

Yes, Microsoft Entra ID supports passkeys by using FIDO2 passkey standards and many authenticators are compatible, including Windows Hello, platform authenticators, and external security keys; Microsoft Entra ID by using these standards supports both bound passkeys and cloud-synced credentials.

What happens if a user's passkey is already registered on another device?

If a passkey is already registered on another device and the user wants to use it elsewhere, they need to either use synced passkeys (if allowed) or register a new passkey on the new device; administrators should consider passkeys for multiple device scenarios when configuring passkey profiles and cloud-based sync options.

Can Intune be used to manage devices that use passkeys and Windows Hello?

Yes, Microsoft Intune can manage device compliance and configuration for devices using passkeys and Windows Hello; Intune policies can ensure device security requirements are met before passkey sign-in is allowed and can be combined with Entra passkey on windows settings for a cohesive deployment.

How do I support passkeys for multiple applications and services in my organization?

Support passkeys for multiple applications by ensuring those applications are federated or integrated with Microsoft Entra ID, enabling passkey sign-in in your authentication settings, and creating passkey profiles that specify whether users can use passkeys for multiple apps and Microsoft 365 services.

What is a cloud passkey provider and do I need one?

A cloud passkey provider stores and syncs passkeys across a user’s devices; using a cloud passkey provider is optional but recommended if you want users to use synced passkeys across devices instead of only bound passkeys tied to single devices.