Entra passkeys on Windows
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 50e5555 · +16 −16 lines · also on GitHub
11
---
22
title: Enable Microsoft Entra passkeys on Windows devices (preview)
33
description: Explains Microsoft Entra passkeys on Windows devices and how admins can enable them for work or school accounts for phishing-resistant multifactor authentication.
4
−#customer intent: As an administrator, I want to enable Microsoft Entra passkeys can users with work and school accounts can sign in by using phishing-resistant multifactor authentication.
4
+#customer intent: As an administrator, I want to enable Microsoft Entra passkeys so users with work and school accounts can sign in by using phishing-resistant multifactor authentication.
55
author: hanki71
66
ms.author: justinha
77
ms.date: 02/18/2026
⋯ 30 unchanged lines
3838
3939
Microsoft Entra passkeys on Windows allow passkeys (FIDO2) to be created and stored inside this Windows Hello container and used for authentication to Microsoft Entra ID.
4040
41
−This behavior is also applicable when the device is governed by Windows Hello for Business policies configured through Microsoft Intune. However, passkeys (FIDO2) are distinct from the Windows Hello for Business credentials that may be automatically registered during device registration to Microsoft Entra ID.
41
+This behavior also applies when the device is governed by Windows Hello for Business policies configured through Microsoft Intune. However, passkeys (FIDO2) are distinct from the Windows Hello for Business credentials that may be automatically registered during device registration to Microsoft Entra ID.
4242
4343
## Supported Windows Hello passkey authenticators (AAGUIDs)
4444
⋯ 1 unchanged line
4646
4747
| Windows Hello authenticator | AAGUID | Description |
4848
|----|----|----|
49
−| Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 | Private key stored in a hardware based TPM. |
49
+| Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 | Private key stored in a hardware-based TPM. |
5050
| Windows Hello VBS Hardware Authenticator | 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 | Virtualization-based Security (VBS) uses hardware virtualization and the Windows hypervisor to store private keys in the host machine's TPM. |
51
−| Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 | Private key stored in a software based TPM. |
51
+| Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 | Private key stored in a software-based TPM. |
5252
5353
These AAGUIDs represent Windows Hello‑backed passkey providers and are used in passkey profiles to allow or block registration.
5454
⋯ 9 unchanged lines
6464
- Windows Hello for Business enables device sign‑in using facial recognition, fingerprint, or PIN protected by Windows Hello.
6565
- Windows Hello for Business provides single sign‑on (SSO) to Microsoft Entra–integrated resources after device sign‑in.
6666
- Windows Hello for Business is primarily a device‑bound sign‑in method linked to device trust.
67
−- Registration and authentication are not controlled by the Entra Authentication Methods Passkey (FIDO2) policy.
67
+- Registration and authentication are not controlled by the Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
6868
6969
### Microsoft Entra passkeys on Windows
7070
⋯ 2 unchanged lines
7373
- Users can register multiple passkeys for multiple Microsoft Entra accounts on the same device.
7474
- Registration and authentication are controlled by using Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
7575
76
−In the majority of cases, if a user has Windows Hello for Business credential, Microsoft Entra prevents them from also registering a passkey (FIDO2) for the same account in the same Windows Hello container to avoid user confusion.
76
+In the majority of cases, if a user has a Windows Hello for Business credential, Microsoft Entra prevents them from also registering a passkey (FIDO2) for the same account in the same Windows Hello container to avoid user confusion.
7777
7878
| Feature | Microsoft Entra passkey on Windows | Windows Hello for Business |
7979
|---|---|---|
⋯ 10 unchanged lines
9090
9191
Use Microsoft Entra passkeys on Windows when:
9292
93
−- You want passkeys (FIDO2) stored locally on Windows
94
−- Users sign in from unregistered, personal, or shared devices
95
−- Users access multiple Microsoft Entra accounts from a single PC
96
−- You want authentication governed by passkey profiles
97
−- You need a standards-based, phishing-resistant sign-in method without device join
93
+- You want passkeys (FIDO2) stored locally on Windows.
94
+- Users sign in from unregistered, personal, or shared devices.
95
+- Users access multiple Microsoft Entra accounts from a single PC.
96
+- You want authentication governed by passkey profiles.
97
+- You need a standards-based, phishing-resistant sign-in method without device join.
9898
9999
Use Windows Hello for Business when:
100100
101
−- You manage corporate owned, Entra joined or registered devices
102
−- You want automatic credential provisioning during device onboarding
103
−- You require tight coupling between device identity and authentication
104
−- You rely on existing Windows Hello for Business lifecycle and policy controls
101
+- You manage corporate-owned, Entra joined or registered devices.
102
+- You want automatic credential provisioning during device onboarding.
103
+- You require tight coupling between device identity and authentication.
104
+- You rely on existing Windows Hello for Business lifecycle and policy controls.
105105
106106
## Attestation support
107107
⋯ 10 unchanged lines
118118
### Prerequisites
119119
120120
- Windows 10 or Windows 11
121
−- Device must be capable of Windows Hello
121
+- Device must support Windows Hello
122122
123123
### Required configuration
124124
⋯ 23 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 18:27 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.