Entra passkeys on Windows
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 61642cb · +4 −4 lines · also on GitHub
⋯ 91 unchanged lines
9292
9393
In the Authentication methods policy in the Microsoft Entra admin center, ensure that **Enforce attestation** is set to **No** for any passkey profile that includes Windows Hello AAGUIDs during public preview.
9494
95
−## Known issues
96
−
97
−During public preview, if a tenant allows Microsoft Entra passkeys on Windows and a user registers a passkey, it appears in the user's list of usable authentication methods in the Microsoft Entra admin center. If the tenant later removes the Windows Hello AAGUIDs from the allow list, the registered passkey remains on the usable authentication methods list instead of moving to the non-usable methods list. Although the passkey appears as usable, authentication with the passkey is governed by the current passkey (FIDO2) policy. If the Windows Hello AAGUIDs are no longer allowed, the passkey can't be used to authenticate. This display issue will be fixed for General Availability.
98
−
9995
## How to configure passkeys on Windows
10096
10197
During public preview, Microsoft Entra passkeys on Windows require an Authentication Policy Administrator to explicitly opt in.
⋯ 36 unchanged lines
138134
**Question**: Are Microsoft Entra passkeys synced?
139135
140136
**Answer**: No. Microsoft Entra passkeys on Windows are device-bound and stored in the local Windows Hello container. They aren't synced across devices. Each device requires a separate passkey registration for each Microsoft Entra account.
137
+
138
+## Known issues
139
+
140
+During public preview, if a tenant allows Microsoft Entra passkeys on Windows and a user registers a passkey, it appears in the user's list of usable authentication methods in the Microsoft Entra admin center. If the tenant later removes the Windows Hello AAGUIDs from the allow list, the registered passkey remains on the usable authentication methods list instead of moving to the non-usable methods list. Although the passkey appears as usable, authentication with the passkey is governed by the current passkey (FIDO2) policy. If the Windows Hello AAGUIDs are no longer allowed, the passkey can't be used to authenticate. This display issue will be fixed for General Availability.
141141
142142
## Related content
143143
⋯ 2 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.