Entra passkeys on Windows
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 0a5a94a · +24 −23 lines · also on GitHub
11
---
22
title: Enable Microsoft Entra passkeys on Windows devices (preview)
3
−description: Explains Microsoft Entra passkeys on Windows devices and how admins can enable them for work or school accounts for phishing-resistant multifactor authentication.
3
+description: Learn how to enable Microsoft Entra passkeys on Windows devices for phishing-resistant multifactor authentication with work or school accounts.
44
#customer intent: As an administrator, I want to enable Microsoft Entra passkeys so users with work and school accounts can sign in by using phishing-resistant multifactor authentication.
55
author: hanki71
66
ms.author: justinha
⋯ 2 unchanged lines
99
ms.service: entra-id
1010
ms.subservice: authentication
1111
ms.collection: msec-ai-copilot
12
+ms.custom: msecd-doc-authoring-106
1213
---
1314
14
−# Microsoft Entra Passkeys on Windows (Preview)
15
+# Enable Microsoft Entra passkeys on Windows (preview)
1516
16
−This article describes Microsoft Entra passkeys on Windows in public preview. It covers how Microsoft Entra passkeys on Windows work, how they differ from Windows Hello for Business, and how to configure passkey profiles to allow Windows Hello as a passkey provider.
17
+This article describes Microsoft Entra passkeys on Windows in public preview. It covers how they work, how they differ from Windows Hello for Business, and how to configure passkey profiles to allow Windows Hello as a passkey provider.
1718
18
−Microsoft Entra passkeys on Windows are currently in public preview and require opt‑in. You need to explicitly configure Microsoft Entra passkeys on Windows to enable the preview of passkey registration in Windows Hello.
19
+Microsoft Entra passkeys on Windows are currently in public preview and require opt-in. You need to explicitly configure them to enable the preview of passkey registration in Windows Hello.
1920
2021
## Overview
2122
22
−Microsoft Entra passkeys on Windows allow users to register passkeys (FIDO2) directly into their device's local Windows Hello container and use them to sign in to Microsoft Entra ID. Microsoft Entra passkeys on Windows enable phishing-resistant sign‑in by using a Windows Hello biometric or PIN without requiring the device to be Microsoft Entra joined or registered.
23
+Microsoft Entra passkeys on Windows allow users to register passkeys (FIDO2) directly into their device's local Windows Hello container and use them to sign in to Microsoft Entra ID. Microsoft Entra passkeys on Windows enable phishing-resistant sign-in by using a Windows Hello biometric or PIN without requiring the device to be Microsoft Entra joined or registered.
2324
2425
By using Microsoft Entra passkeys on Windows:
2526
⋯ 4 unchanged lines
3031
3132
## How Microsoft Entra passkeys on Windows work
3233
33
−Windows Hello acts as a secure local credential container on Windows devices. The container is protected by user‑presence verification such as:
34
+Windows Hello acts as a secure local credential container on Windows devices. The container is protected by user-presence verification such as:
3435
3536
- PIN
3637
- Fingerprint
⋯ 3 unchanged lines
4041
4142
This behavior also applies when the device is governed by Windows Hello for Business policies configured through Microsoft Intune. However, passkeys (FIDO2) are distinct from the Windows Hello for Business credentials that may be automatically registered during device registration to Microsoft Entra ID.
4243
43
−## Supported Windows Hello passkey authenticators (AAGUIDs)
44
+## Supported Windows Hello passkey Authenticator Attestation GUIDs (AAGUIDs)
4445
45
−During public preview, Windows Hello passkeys are identified and controlled using the following Authenticator Attestation GUIDs (AAGUIDs). These AAGUIDs must be explicitly allowed in a passkey profile to enable registration.
46
+During public preview, Windows Hello passkeys are identified and controlled by using the following AAGUIDs. These AAGUIDs must be explicitly allowed in a passkey profile to enable registration.
4647
4748
| Windows Hello authenticator | AAGUID | Description |
4849
|----|----|----|
⋯ 11 unchanged lines
6061
6162
- Windows Hello for Business credentials are automatically provisioned on some Microsoft Entra joined or registered devices during device registration.
6263
- The credential is tied only to the Microsoft Entra account used to register the device.
63
−- Windows Hello for Business credentials are passkeys using a first‑party (1P) protocol, but not FIDO2 passkeys.
64
−- Windows Hello for Business enables device sign‑in using facial recognition, fingerprint, or PIN protected by Windows Hello.
65
−- Windows Hello for Business provides single sign‑on (SSO) to Microsoft Entra–integrated resources after device sign‑in.
66
−- Windows Hello for Business is primarily a device‑bound sign‑in method linked to device trust.
67
−- Registration and authentication are not controlled by the Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
64
+- Windows Hello for Business credentials are passkeys using a first-party (1P) protocol, but not FIDO2 passkeys.
65
+- Windows Hello for Business enables device sign-in using facial recognition, fingerprint, or PIN protected by Windows Hello.
66
+- Windows Hello for Business provides single sign-on (SSO) to Microsoft Entra-integrated resources after device sign-in.
67
+- Windows Hello for Business is primarily a device-bound sign-in method linked to device trust.
68
+- Registration and authentication aren't controlled by the Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
6869
6970
### Microsoft Entra passkeys on Windows
7071
⋯ 1 unchanged line
7273
- They can be registered without device join or registration.
7374
- Users can register multiple passkeys for multiple Microsoft Entra accounts on the same device.
7475
- Registration and authentication are controlled by using Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
75
−- Cannot be used for device sign-in.
76
+- They can't be used for device sign-in.
7677
77
−>[!NOTE]
78
−>If you're on an Entra joined or Entra registered device, setting up Windows Hello may automatically register a Windows Hello for Business credential for the device's linked account. If you then attempt to register a passkey on Windows for that same account, registration will fail because the WHFB credential already exists. On retry, you'll see an error indicating the passkey is already registered.
78
+> [!NOTE]
79
+> If you're on a Microsoft Entra joined or Microsoft Entra registered device, setting up Windows Hello might automatically register a Windows Hello for Business credential for the device's linked account. If you then attempt to register a passkey on Windows for that same account, registration fails because the Windows Hello for Business credential already exists. On retry, you'll see an error indicating the passkey is already registered.
7980
8081
| Feature | Microsoft Entra passkey on Windows | Windows Hello for Business |
8182
|---|---|---|
8283
| Standard base | FIDO2 | First-party (1P) protocol |
83
−| Registration | User-initiated, does not require device join or registration | Automatically provisioned on some Entra joined or registered devices during device registration |
84
−| Device sign-in and single sign-on (SSO) | N/A | Enables device sign‑in and SSO to Microsoft Entra–integrated resources after device sign‑in |
84
+| Registration | User-initiated, doesn't require device join or registration | Automatically provisioned on some Microsoft Entra joined or registered devices during device registration |
85
+| Device sign-in and single sign-on (SSO) | N/A | Enables device sign-in and SSO to Microsoft Entra-integrated resources after device sign-in |
8586
| Passkey type | Device-bound | Device-bound |
86
−| Credential binding | Bound to the device and stored in the local Windows Hello container. Users can register multiple passkeys for multiple work or school accounts on the same device. | Primarily a device‑bound sign‑in method linked to device trust. The credential is tied only to the work or school account used to register the device. |
87
+| Credential binding | Bound to the device and stored in the local Windows Hello container. Users can register multiple passkeys for multiple work or school accounts on the same device. | Primarily a device-bound sign-in method linked to device trust. The credential is tied only to the work or school account used to register the device. |
8788
| Management | Microsoft Entra ID Authentication methods policy | Microsoft Intune<br>Group Policy |
8889
8990
## Attestation support
⋯ 6 unchanged lines
9697
9798
During public preview, Microsoft Entra passkeys on Windows require an Authentication Policy Administrator to explicitly opt in.
9899
99
−To enable registration, all of the following prerequisites and configuration requirements must be met.
100
+To enable registration, you need to meet all of the following prerequisites and configuration requirements.
100101
101102
### Prerequisites
102103
⋯ 8 unchanged lines
111112
112113
:::image type="content" source="media/how-to-authentication-entra-passkeys-on-windows/passkey-profile.png" alt-text="Screenshot of the passkey profile configuration settings showing Windows Hello AAGUIDs configuration options.":::
113114
114
−>[!NOTE]
115
−>During public preview, passkey registration in Windows Hello is blocked unless the Windows Hello AAGUIDs are explicitly allowed in a passkey profile. For General Availability, you won’t be required to explicitly allow Windows Hello AAGUIDs.
115
+> [!NOTE]
116
+> During public preview, passkey registration in Windows Hello is blocked unless the Windows Hello AAGUIDs are explicitly allowed in a passkey profile. For General Availability, you won’t be required to explicitly allow Windows Hello AAGUIDs.
116117
117118
## FAQ
118119
⋯ 7 unchanged lines
126127
127128
**Question**: Do Microsoft Entra passkeys on Windows replace Windows Hello for Business?
128129
129
−**Answer**: No. Microsoft Entra passkeys on Windows don't replace Windows Hello for Business. Windows Hello for Business remains the recommended solution for signing into corporate managed, Microsoft Entra joined or registered devices. Microsoft Entra passkeys on Windows complement Windows Hello for Business by enabling passkeys (FIDO2) on Windows in scenarios where devices are not joined or registered. Microsoft Entra passkeys on Windows don't support device sign-in.
130
+**Answer**: No. Microsoft Entra passkeys on Windows don't replace Windows Hello for Business. Windows Hello for Business remains the recommended solution for signing into corporate managed, Microsoft Entra joined or registered devices. Microsoft Entra passkeys on Windows complement Windows Hello for Business by enabling passkeys (FIDO2) on Windows in scenarios where devices aren't joined or registered. Microsoft Entra passkeys on Windows don't support device sign-in.
130131
131132
> [!NOTE]
132133
> Users can't register a passkey on Windows if a Windows Hello for Business credential already exists for the same account and container. This block may not apply once the user exceeds 50 total platform credentials.
⋯ 13 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.