Entra passkeys on Windows
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3d0b94d · +5 −22 lines · also on GitHub
⋯ 25 unchanged lines
2626
- Users can register passkeys (FIDO2) in the local Windows Hello container.
2727
- Devices don't need to be joined or registered to Microsoft Entra to use a local Windows passkey.
2828
- A single Windows PC can store multiple passkeys for multiple Microsoft Entra accounts.
29
−- Passkeys (FIDO2) registered in Windows Hello participate in Microsoft Entra passkey (FIDO2) policies and passkey profiles.
29
+- Passkeys (FIDO2) registered in Windows Hello are governed by Microsoft Entra passkey (FIDO2) policies and passkey profiles.
3030
3131
## How Microsoft Entra passkeys on Windows work
3232
⋯ 17 unchanged lines
5050
| Windows Hello VBS Hardware Authenticator | 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 | Virtualization-based Security (VBS) uses hardware virtualization and the Windows hypervisor to store private keys in the host machine's TPM. |
5151
| Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 | Private key stored in a software-based TPM. |
5252
53
−These AAGUIDs represent Windows Hello‑backed passkey providers and are used in passkey profiles to allow or block registration.
53
+These AAGUIDs represent Windows Hello passkey providers and are used in passkey profiles to allow or block registration.
5454
5555
## How Microsoft Entra passkeys on Windows compare with Windows Hello for Business
5656
⋯ 15 unchanged lines
7272
- They can be registered without device join or registration.
7373
- Users can register multiple passkeys for multiple Microsoft Entra accounts on the same device.
7474
- Registration and authentication are controlled by using Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
75
+- Cannot be used for device sign-in.
7576
76
−In the majority of cases, if a user has a Windows Hello for Business credential, Microsoft Entra prevents them from also registering a passkey (FIDO2) for the same account in the same Windows Hello container to avoid user confusion.
77
+>[!NOTE]
78
+>If you're on an Entra joined or Entra registered device, setting up Windows Hello may automatically register a Windows Hello for Business credential for the device's linked account. If you then attempt to register a passkey on Windows for that same account, registration will fail because the WHFB credential already exists. On retry, you'll see an error indicating the passkey is already registered.
7779
7880
| Feature | Microsoft Entra passkey on Windows | Windows Hello for Business |
7981
|---|---|---|
⋯ 3 unchanged lines
8385
| Passkey type | Device-bound | Device-bound |
8486
| Credential binding | Bound to the device and stored in the local Windows Hello container. Users can register multiple passkeys for multiple work or school accounts on the same device. | Primarily a device‑bound sign‑in method linked to device trust. The credential is tied only to the work or school account used to register the device. |
8587
| Management | Microsoft Entra ID Authentication methods policy | Microsoft Intune<br>Group Policy |
86
−
87
−### Use cases
88
−
89
−Many organizations use Windows Hello for Business for managed devices, and use Microsoft Entra passkeys on Windows to cover personal or unmanaged scenarios.
90
−
91
−Use Microsoft Entra passkeys on Windows when:
92
−
93
−- You want passkeys (FIDO2) stored locally on Windows.
94
−- Users sign in from unregistered, personal, or shared devices.
95
−- Users access multiple Microsoft Entra accounts from a single PC.
96
−- You want authentication governed by passkey profiles.
97
−- You need a standards-based, phishing-resistant sign-in method without device join.
98
−
99
−Use Windows Hello for Business when:
100
−
101
−- You manage corporate-owned, Entra joined or registered devices.
102
−- You want automatic credential provisioning during device onboarding.
103
−- You require tight coupling between device identity and authentication.
104
−- You rely on existing Windows Hello for Business lifecycle and policy controls.
10588
10689
## Attestation support
10790
⋯ 40 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.