Entra passkeys on Windows
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5571133 · +8 −34 lines · also on GitHub
11
---
2
−title: Enable Microsoft Entra passkey on Windows devices (preview)
2
+title: Enable Microsoft Entra passkey on Windows devices
33
description: Learn how to enable Microsoft Entra passkey on Windows devices for phishing-resistant multifactor authentication with work or school accounts.
44
#customer intent: As an administrator, I want to enable Microsoft Entra passkeys so users with work and school accounts can sign in by using phishing-resistant multifactor authentication.
55
author: hanki71
⋯ 6 unchanged lines
1212
ms.custom: msecd-doc-authoring-106
1313
---
1414
15
−# Enable Microsoft Entra passkey on Windows (preview)
16
−
17
−This article describes Microsoft Entra passkey on Windows in public preview. It covers how they work, how they differ from Windows Hello for Business, and how to configure passkey profiles to allow Windows Hello as a passkey provider.
15
+# Enable Microsoft Entra passkey on Windows
1816
19
−Microsoft Entra passkey on Windows is currently in public preview and requires opt-in. You need to explicitly configure them to enable the preview of passkey registration in Windows Hello.
17
+This article describes Microsoft Entra passkey on Windows. It covers how they work, how they differ from Windows Hello for Business, and how to configure passkey profiles to allow Windows Hello as a passkey provider.
2018
2119
## Overview
2220
⋯ 18 unchanged lines
4139
4240
This behavior also applies when the device is governed by Windows Hello for Business policies configured through Microsoft Intune. However, passkeys (FIDO2) are distinct from the Windows Hello for Business credentials that may be automatically registered during device registration to Microsoft Entra ID.
4341
44
−## Supported Windows Hello passkey Authenticator Attestation GUIDs (AAGUIDs)
45
−
46
−During public preview, Windows Hello passkeys are identified and controlled by using the following AAGUIDs. These AAGUIDs must be explicitly allowed in a passkey profile to enable registration.
47
−
48
−| Windows Hello authenticator | AAGUID | Description |
49
−|----|----|----|
50
−| Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 | Private key stored in a hardware-based TPM. |
51
−| Windows Hello VBS Hardware Authenticator | 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 | Virtualization-based Security (VBS) uses hardware virtualization and the Windows hypervisor to store private keys in the host machine's TPM. |
52
−| Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 | Private key stored in a software-based TPM. |
53
−
54
−These AAGUIDs represent Windows Hello passkey providers and are used in passkey profiles to allow or block registration.
55
−
5642
## How Microsoft Entra passkey on Windows compares with Windows Hello for Business
5743
5844
Although both features use Windows Hello, Microsoft Entra passkey on Windows and Windows Hello for Business have different purposes and behavior.
⋯ 13 unchanged lines
7258
- Microsoft Entra passkey on Windows is a FIDO2 passkey.
7359
- They can be registered without device join or registration.
7460
- Users can register multiple passkeys for multiple Microsoft Entra accounts on the same device.
75
−- Registration and authentication are controlled by using Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
61
+- Registration and authentication are managed by the **Passkey (FIDO2)** policy in Microsoft Entra ID Authentication methods.
7662
- They can't be used for device sign-in.
7763
7864
> [!NOTE]
⋯ 10 unchanged lines
8975
9076
## Attestation support
9177
92
−Attestation isn't supported for Microsoft Entra passkey on Windows during public preview. As a result, if **Enforce attestation** is enabled in a passkey profile that allows Windows Hello AAGUIDs, passkey registration attempts to Windows Hello will fail.
93
−
94
−In the Authentication methods policy in the Microsoft Entra admin center, ensure that **Enforce attestation** is set to **No** for any passkey profile that includes Windows Hello AAGUIDs during public preview.
78
+Attestation isn't supported for Microsoft Entra passkey on Windows. As a result, if **Enforce attestation** is selected in a passkey profile, passkey registration attempts to Windows Hello will fail.
9579
9680
## How to configure passkeys on Windows
9781
98
−During public preview, Microsoft Entra passkey on Windows requires an Authentication Policy Administrator to explicitly opt in.
99
−
10082
To enable registration, you need to meet all of the following prerequisites and configuration requirements.
10183
10284
### Prerequisites
⋯ 3 unchanged lines
10688
10789
### Required configuration
10890
109
−- You must explicitly include the Windows Hello AAGUIDs in an allow list in a passkey profile.
110
−- Attestation must not be enforced.
111
−- Key restrictions must be enabled.
112
−
113
−:::image type="content" source="media/how-to-authentication-entra-passkeys-on-windows/passkey-profile.png" alt-text="Screenshot of the passkey profile configuration settings showing Windows Hello AAGUIDs configuration options.":::
91
+- **Enforce attestation** can't be selected.
92
+- **Passkey types** must include **Device-bound**.
11493
115
−> [!NOTE]
116
−> During public preview, passkey registration in Windows Hello is blocked unless the Windows Hello AAGUIDs are explicitly allowed in a passkey profile. For General Availability, you won’t be required to explicitly allow Windows Hello AAGUIDs.
94
+:::image type="content" border="true" source="media/how-to-authentication-entra-passkeys-on-windows/passkey-on-windows-profile.png" alt-text="Screenshot of the Add passkey profile settings showing Enforce attestation cleared and Passkey types set to Device-bound.":::
11795
11896
## FAQ
11997
⋯ 15 unchanged lines
135113
**Question**: Are Microsoft Entra passkeys synced?
136114
137115
**Answer**: No. Microsoft Entra passkey on Windows is device-bound and stored in the local Windows Hello container. It isn't synced across devices. Each device requires a separate passkey registration for each Microsoft Entra account.
138
−
139
−## Known issues
140
−
141
−During public preview, if a tenant allows Microsoft Entra passkey on Windows and a user registers a passkey, it appears in the user's list of usable authentication methods in the Microsoft Entra admin center. If the tenant later removes the Windows Hello AAGUIDs from the allow list, the registered passkey remains on the usable authentication methods list instead of moving to the non-usable methods list. Although the passkey appears as usable, authentication with the passkey is governed by the current passkey (FIDO2) policy. If the Windows Hello AAGUIDs are no longer allowed, the passkey can't be used to authenticate. This display issue will be fixed for General Availability.
142116
143117
## Related content
144118
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.