Entra passkeys on Windows
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 50ce93f · +49 −0 lines · also on GitHub
⋯ 8 unchanged lines
99
ms.subservice: authentication
1010
ms.collection: msec-ai-copilot
1111
ms.custom: msecd-doc-authoring-106
12
+ai-usage: ai-assisted
1213
---
1314
1415
# Enable Microsoft Entra passkey on Windows
⋯ 61 unchanged lines
7677
7778
Attestation isn't supported for Microsoft Entra passkey on Windows. As a result, if **Enforce attestation** is selected in a passkey profile, passkey registration attempts to Windows Hello will fail.
7879
80
+## Supported Windows Hello passkey Authenticator Attestation GUIDs (AAGUIDs)
81
+
82
+During public preview, Windows Hello passkeys are identified and controlled by using the following AAGUIDs. These AAGUIDs must be explicitly allowed in a passkey profile to enable registration.
83
+
84
+| Windows Hello authenticator | AAGUID | Description |
85
+|----|----|----|
86
+| Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 | Private key stored in a hardware-based Trusted Platform Module (TPM). |
87
+| Windows Hello VBS Hardware Authenticator | 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 | Virtualization-based Security (VBS) uses hardware virtualization and the Windows hypervisor to store private keys in the host machine's TPM. |
88
+| Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 | Private key stored in a software-based TPM. |
89
+
90
+These AAGUIDs represent Windows Hello passkey providers and are used in passkey profiles to allow or block registration.
91
+
7992
## How to configure passkeys on Windows
8093
8194
To enable registration, you need to meet all of the following prerequisites and configuration requirements.
⋯ 9 unchanged lines
91104
- **Passkey types** must include **Device-bound**.
92105
93106
:::image type="content" border="true" source="media/how-to-authentication-entra-passkeys-on-windows/passkey-on-windows-profile.png" alt-text="Screenshot of the Add passkey profile settings showing Enforce attestation cleared and Passkey types set to Device-bound.":::
107
+
108
+### Example: Allow Microsoft Authenticator and Windows Hello passkeys
109
+
110
+You can target specific AAGUIDs to control which authenticators users can register. In this example, the passkey profile allows passkeys on Windows or Microsoft Authenticator.
111
+
112
+To configure this profile:
113
+
114
+1. Select **Target specific AAGUIDs**.
115
+1. Set **Behavior** to **Allow**.
116
+1. Under **Model/Provider AAGUIDs**, add the AAGUIDs for both Microsoft Authenticator and Windows Hello:
117
+
118
+ | Authenticator | AAGUID |
119
+ |----|----|
120
+ | Microsoft Authenticator for Android | de1e552d-db1d-4423-a619-566b625cdc84 |
121
+ | Microsoft Authenticator for iOS | 90a3ccdf-635c-4729-a248-9b709135078f |
122
+ | Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 |
123
+ | Windows Hello VBS Hardware Authenticator | 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 |
124
+ | Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 |
125
+
126
+With this configuration, users can register passkeys with Microsoft Authenticator or with Windows Hello on Windows because both sets of AAGUIDs are in the allowed list.
127
+
128
+:::image type="content" border="true" source="media/how-to-authentication-entra-passkeys-on-windows/authenticator-windows-passkey-profile.png" alt-text="Screenshot of the Add passkey profile settings with Target specific AAGUIDs selected, Behavior set to Allow, and the Microsoft Authenticator and Windows Hello AAGUIDs added.":::
129
+
130
+### Example: Allow only Windows Hello Hardware Authenticators
131
+
132
+You can also target specific AAGUIDs to require hardware-backed Windows Hello passkeys. In this example, a high assurance passkey profile allows only Windows Hello Hardware Authenticators and doesn't allow the Windows Hello Software Authenticator.
133
+
134
+To configure this restriction:
135
+
136
+1. Select **Target specific AAGUIDs**.
137
+1. Set **Behavior** to **Allow**.
138
+1. Under **Model/Provider AAGUIDs**, add the AAGUIDs for **Windows Hello Hardware Authenticator** and **Windows Hello VBS Hardware Authenticator**.
139
+
140
+With this configuration, users can register passkeys on Windows only when their device supports hardware-backed Windows Hello. Because the Windows Hello Software Authenticator AAGUID isn't in the allowed list, software-only registrations are blocked.
141
+
142
+:::image type="content" border="true" source="media/how-to-authentication-entra-passkeys-on-windows/high-assurance-passkey-profile.png" alt-text="Screenshot of the Add passkey profile settings with Target specific AAGUIDs selected, Behavior set to Allow, and the Windows Hello Hardware Authenticator and Windows Hello VBS Hardware Authenticator AAGUIDs added.":::
94143
95144
## FAQ
96145
⋯ 23 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:34 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.