ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Entra passkeys on Windows

This page's changes and edits · All guidance changes

Microsoft's edit ·

Split passkey docs (3/5): Microsoft Entra passkey on Windows (enable/register/sign-in) (#13775)

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 9e28efd · +72 −61 lines · also on GitHub

11 ---
2 −title: Enable Microsoft Entra passkey on Windows devices
3 −description: Learn how to enable Microsoft Entra passkey on Windows devices for phishing-resistant multifactor authentication with work or school accounts.
4 −#customer intent: As an administrator, I want to enable Microsoft Entra passkeys so users with work and school accounts can sign in by using phishing-resistant multifactor authentication.
5 −ms.reviewer: kimhana
6 −ms.date: 02/18/2026
2 +title: Enable Microsoft Entra passkey on Windows (preview)
3 +description: Learn how Microsoft Entra passkey on Windows enables phishing-resistant authentication with work or school accounts by using Windows Hello as a FIDO2 passkey provider.
4 +#customer intent: As an administrator, I want to understand Microsoft Entra passkeys on Windows so users with work and school accounts can sign in by using phishing-resistant multifactor authentication.
5 +author: hanki71
6 +ms.author: justinha
7 +ms.date: 07/05/2026
78 ms.topic: how-to
89 ms.service: entra-id
910 ms.subservice: authentication
1011 ms.collection: msec-ai-copilot
11 −ms.custom: msecd-doc-authoring-106
12 +ms.custom: msecd-doc-authoring-1013
1213 ai-usage: ai-assisted
1314 ---
1415
15 −# Enable Microsoft Entra passkey on Windows
16 +# Enable Microsoft Entra passkey on Windows (preview)
1617
17 −This article describes Microsoft Entra passkey on Windows. It covers how they work, how they differ from Windows Hello for Business, and how to configure passkey profiles to allow Windows Hello as a passkey provider.
18 +This article describes Microsoft Entra passkey on Windows, how it works, and how it differs from Windows Hello for Business.
1819
20 +To configure passkey profiles that allow Windows Hello as a FIDO2 passkey provider, see [Configure a profile for Microsoft Entra passkey on Windows](#configure-a-profile-for-microsoft-entra-passkey-on-windows).
21 +
1922 ## Overview
2023
21 −Microsoft Entra passkey on Windows allows users to register passkeys (FIDO2) directly into their device's local Windows Hello container and use them to sign in to Microsoft Entra ID. Microsoft Entra passkey on Windows enables phishing-resistant sign-in by using a Windows Hello biometric or PIN without requiring the device to be Microsoft Entra joined or registered.
24 +Microsoft Entra passkey on Windows allows users to register passkeys (FIDO2) directly into their device's local Windows Hello container. Users can then use these passkeys to sign in to Microsoft Entra ID. Microsoft Entra passkey on Windows enables phishing-resistant sign-in by using a Windows Hello biometric or PIN without requiring the device to be Microsoft Entra joined or registered.
2225
2326 By using Microsoft Entra passkey on Windows:
2427
⋯ 12 unchanged lines
3740
3841 Microsoft Entra passkey on Windows allows passkeys (FIDO2) to be created and stored inside this Windows Hello container and used for authentication to Microsoft Entra ID.
3942
40 −This behavior also applies when the device is governed by Windows Hello for Business policies configured through Microsoft Intune. However, passkeys (FIDO2) are distinct from the Windows Hello for Business credentials that may be automatically registered during device registration to Microsoft Entra ID.
43 +This behavior also applies when the device is governed by Windows Hello for Business policies configured through Microsoft Intune. However, passkeys (FIDO2) are distinct from the Windows Hello for Business credentials that might be automatically registered during device registration to Microsoft Entra ID.
4144
4245 ## How Microsoft Entra passkey on Windows compares with Windows Hello for Business
4346
4447 Although both features use Windows Hello, Microsoft Entra passkey on Windows and Windows Hello for Business have different purposes and behavior.
4548
46 −### Windows Hello for Business
47 −
48 −- Windows Hello for Business credentials are automatically provisioned on some Microsoft Entra joined or registered devices during device registration.
49 −- The credential is tied only to the Microsoft Entra account used to register the device.
50 −- Windows Hello for Business credentials are passkeys using a first-party (1P) protocol, but not FIDO2 passkeys.
51 −- Windows Hello for Business enables device sign-in using facial recognition, fingerprint, or PIN protected by Windows Hello.
52 −- Windows Hello for Business provides single sign-on (SSO) to Microsoft Entra-integrated resources after device sign-in.
53 −- Windows Hello for Business is primarily a device-bound sign-in method linked to device trust.
54 −- Registration and authentication aren't controlled by the Microsoft Entra Authentication Methods Passkey (FIDO2) policy.
55 −
56 −### Microsoft Entra passkey on Windows
57 −
58 −- Microsoft Entra passkey on Windows is a FIDO2 passkey.
59 −- They can be registered without device join or registration.
60 −- Users can register multiple passkeys for multiple Microsoft Entra accounts on the same device.
61 −- Registration and authentication are managed by the **Passkey (FIDO2)** policy in Microsoft Entra ID Authentication methods.
62 −- They can't be used for device sign-in.
63 −
64 −> [!NOTE]
65 −> If you're on a Microsoft Entra joined or Microsoft Entra registered device, setting up Windows Hello might automatically register a Windows Hello for Business credential for the device's linked account. If you then attempt to register a passkey on Windows for that same account, registration fails because the Windows Hello for Business credential already exists. On retry, you'll see an error indicating the passkey is already registered.
66 −
6749 | Feature | Microsoft Entra passkey on Windows | Windows Hello for Business |
6850 |---|---|---|
6951 | Standard base | FIDO2 | FIDO2 for authentication, first-party (1P) protocol for device sign-in |
⋯ 3 unchanged lines
7355 | Credential binding | Bound to the device and stored in the local Windows Hello container. Users can register multiple passkeys for multiple work or school accounts on the same device. | Primarily a device-bound sign-in method linked to device trust. The credential is tied only to the work or school account used to register the device. |
7456 | Management | Microsoft Entra ID Authentication methods policy | Microsoft Intune<br>Group Policy |
7557
76 −## Attestation support
58 +> [!NOTE]
59 +> If you're on a Microsoft Entra joined or Microsoft Entra registered device, setting up Windows Hello might automatically register a Windows Hello for Business credential for the device's linked account. If you then attempt to register a passkey on Windows for that same account, registration fails because the Windows Hello for Business credential already exists. On retry, you see an error indicating the passkey is already registered.
7760
78 −Attestation isn't supported for Microsoft Entra passkey on Windows. As a result, if **Enforce attestation** is selected in a passkey profile, passkey registration attempts to Windows Hello will fail.
61 +## Prerequisites for Microsoft Entra passkey on Windows
7962
80 −## Supported Windows Hello passkey Authenticator Attestation GUIDs (AAGUIDs)
63 +- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions to configure authentication methods.
64 +- You need to [enable passkey sign-in](how-to-authentication-passkeys-fido2.md#enable-passkey-profiles) in the **Passkey (FIDO2)** policy in **Authentication methods** in the Microsoft Entra admin center.
65 +- Windows 10 or Windows 11
66 +- Device must support Windows Hello
8167
82 −During public preview, Windows Hello passkeys are identified and controlled by using the following AAGUIDs. These AAGUIDs must be explicitly allowed in a passkey profile to enable registration.
68 +## Supported Windows Hello passkey AAGUIDs
8369
70 +Windows Hello passkeys are identified and controlled by using the following AAGUIDs. These AAGUIDs must be explicitly allowed in a passkey profile to enable registration.
71 +
8472 | Windows Hello authenticator | AAGUID | Description |
8573 |----|----|----|
86 −| Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 | Private key stored in a hardware-based Trusted Platform Module (TPM). |
74 +| Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 | Private key stored in a hardware-based TPM. |
8775 | Windows Hello VBS Hardware Authenticator | 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 | Virtualization-based Security (VBS) uses hardware virtualization and the Windows hypervisor to store private keys in the host machine's TPM. |
8876 | Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 | Private key stored in a software-based TPM. |
8977
90 −These AAGUIDs represent Windows Hello passkey providers and are used in passkey profiles to allow or block registration.
91 −
92 −## How to configure passkeys on Windows
78 +## Configure a profile for Microsoft Entra passkey on Windows
9379
94 −To enable registration, you need to meet all of the following prerequisites and configuration requirements.
80 +Microsoft Entra passkey on Windows requires an Authentication Policy Administrator to configure a passkey profile with the following settings:
9581
96 −### Prerequisites
82 +- The profile must target the specific Windows Hello AAGUIDs.
83 +- The profile can't **Enforce attestation**.
9784
98 −- Windows 10 or Windows 11
99 −- Device must support Windows Hello
85 +1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
86 +1. Browse to **Entra ID** > **Authentication methods**.
87 +1. On the **Authentication methods | Policies** page, select **Passkey (FIDO2)** > **Configure**.
88 +1. Select **+ Add profile**.
10089
101 −### Required configuration
90 + :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-passkey-profile.png" alt-text="Screenshot that shows how to add a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-passkey-profile.png":::
10291
103 −- **Enforce attestation** can't be selected.
104 −- **Passkey types** must include **Device-bound**.
92 +1. Enter a **Name** for the profile, such as **Entra passkey on Windows**.
93 +1. For **Passkey types**, select **Device-bound**.
94 +1. Select **Target specific AAGUIDS** and set **Behavior** to **Allow**.
95 +1. Select **+ Add AAGUID** > **Windows Hello** and **Save**.
10596
106 −:::image type="content" border="true" source="media/how-to-authentication-entra-passkeys-on-windows/passkey-on-windows-profile.png" alt-text="Screenshot of the Add passkey profile settings showing Enforce attestation cleared and Passkey types set to Device-bound.":::
97 + :::image type="content" source="media/how-to-authentication-passkey-profiles/select-windows-hello.png" alt-text="Screenshot of the passkey profile configuration settings showing Windows Hello AAGUIDs configuration options." lightbox="media/how-to-authentication-passkey-profiles/select-windows-hello.png":::
10798
10899 ### Example: Allow Microsoft Authenticator and Windows Hello passkeys
109100
⋯ 3 unchanged lines
113104
114105 1. Select **Target specific AAGUIDs**.
115106 1. Set **Behavior** to **Allow**.
116 −1. Under **Model/Provider AAGUIDs**, add the AAGUIDs for both Microsoft Authenticator and Windows Hello:
117 −
118 − | Authenticator | AAGUID |
119 − |----|----|
120 − | Microsoft Authenticator for Android | de1e552d-db1d-4423-a619-566b625cdc84 |
121 − | Microsoft Authenticator for iOS | 90a3ccdf-635c-4729-a248-9b709135078f |
122 − | Windows Hello Hardware Authenticator | 08987058-cadc-4b81-b6e1-30de50dcbe96 |
123 − | Windows Hello VBS Hardware Authenticator | 9ddd1817-af5a-4672-a2b9-3e3dd95000a9 |
124 − | Windows Hello Software Authenticator | 6028b017-b1d4-4c02-b4b3-afcdafc96bb2 |
107 +1. Select **+ Add AAGUID** > **Windows Hello** and **Save**. Select **+ Add AAGUID** > **Microsoft Authenticator** and **Save**.
125108
126109 With this configuration, users can register passkeys with Microsoft Authenticator or with Windows Hello on Windows because both sets of AAGUIDs are in the allowed list.
127110
128 −:::image type="content" border="true" source="media/how-to-authentication-entra-passkeys-on-windows/authenticator-windows-passkey-profile.png" alt-text="Screenshot of the Add passkey profile settings with Target specific AAGUIDs selected, Behavior set to Allow, and the Microsoft Authenticator and Windows Hello AAGUIDs added.":::
111 +:::image type="content" source="media/how-to-authentication-entra-passkeys-on-windows/authenticator-windows-passkey-profile.png" alt-text="Screenshot of the Add passkey profile settings with Target specific AAGUIDs selected, Behavior set to Allow, and the Microsoft Authenticator and Windows Hello AAGUIDs added." lightbox="media/how-to-authentication-entra-passkeys-on-windows/authenticator-windows-passkey-profile.png":::
129112
130113 ### Example: Allow only Windows Hello Hardware Authenticators
131114
⋯ 3 unchanged lines
135118
136119 1. Select **Target specific AAGUIDs**.
137120 1. Set **Behavior** to **Allow**.
138 −1. Under **Model/Provider AAGUIDs**, add the AAGUIDs for **Windows Hello Hardware Authenticator** and **Windows Hello VBS Hardware Authenticator**.
121 +1. Under **Model/Provider AAGUIDs**, add the AAGUIDs for **Windows Hello Hardware Authenticator** and **Windows Hello VBS Hardware Authenticator**, and **Save**.
139122
140123 With this configuration, users can register passkeys on Windows only when their device supports hardware-backed Windows Hello. Because the Windows Hello Software Authenticator AAGUID isn't in the allowed list, software-only registrations are blocked.
141124
142 −:::image type="content" border="true" source="media/how-to-authentication-entra-passkeys-on-windows/high-assurance-passkey-profile.png" alt-text="Screenshot of the Add passkey profile settings with Target specific AAGUIDs selected, Behavior set to Allow, and the Windows Hello Hardware Authenticator and Windows Hello VBS Hardware Authenticator AAGUIDs added.":::
125 +:::image type="content" source="media/how-to-authentication-entra-passkeys-on-windows/high-assurance-passkey-profile.png" alt-text="Screenshot of the Add passkey profile settings with Target specific AAGUIDs selected, Behavior set to Allow, and the Windows Hello Hardware Authenticator and Windows Hello VBS Hardware Authenticator AAGUIDs added." lightbox="media/how-to-authentication-entra-passkeys-on-windows/high-assurance-passkey-profile.png":::
143126
127 +## Enable and target groups for a profile for Microsoft Entra passkeys on Windows
128 +
129 +1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
130 +1. Browse to **Entra ID** > **Authentication methods**.
131 +1. On the **Authentication methods | Policies** page, select **Passkey (FIDO2)** > **Enable and target**.
132 +1. On the **Enable and Target** tab, make sure **Enable** is **On**.
133 +1. Select **Add target**, and choose **All users** or **Select targets** to choose specific groups.
134 +
135 + :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-target.png" alt-text="Screenshot that shows how to add a target for a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-target.png":::
136 +
137 +1. Select the profile for Microsoft Entra passkey on Windows, and select **Save**.
138 +
139 + :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/enable-target-windows.png" alt-text="Screenshot that shows how to enable and target a profile for Microsoft Entra passkey on Windows." lightbox="media/how-to-authentication-passkey-profiles/enable-target-windows.png":::
140 +
144141 ## FAQ
145142
146143 **Question**: What is the use case for Microsoft Entra passkey on Windows?
⋯ 9 unchanged lines
156153 **Answer**: No. Microsoft Entra passkey on Windows doesn't replace Windows Hello for Business. Windows Hello for Business remains the recommended solution for signing into corporate managed, Microsoft Entra joined or registered devices. Microsoft Entra passkey on Windows complements Windows Hello for Business by enabling passkeys (FIDO2) on Windows in scenarios where devices aren't joined or registered. Microsoft Entra passkey on Windows doesn't support device sign-in.
157154
158155 > [!NOTE]
159 −> Users can't register a passkey on Windows if a Windows Hello for Business credential already exists for the same account and container. This block may not apply once the user exceeds 50 total platform credentials.
156 +> Users can't register a passkey on Windows if a Windows Hello for Business credential already exists for the same account and container. This block might not apply once the user exceeds 50 total platform credentials.
160157
161158 **Question**: Are Microsoft Entra passkeys synced?
162159
163160 **Answer**: No. Microsoft Entra passkey on Windows is device-bound and stored in the local Windows Hello container. It isn't synced across devices. Each device requires a separate passkey registration for each Microsoft Entra account.
164161
162 +## Register a Microsoft Entra passkey on Windows
163 +
164 +After an admin creates the Windows passkey profile, users can register a passkey directly into the local Windows Hello container on their device.
165 +
166 +For registration steps, see [Register a Microsoft Entra passkey on Windows](how-to-register-entra-passkey-windows.md).
167 +
168 +## Sign in with a Microsoft Entra passkey on Windows
169 +
170 +After registration, users can sign in to Microsoft Entra ID by using the passkey stored in Windows Hello on their device.
171 +
172 +For sign-in steps, see [Sign in with a Microsoft Entra passkey on Windows](how-to-sign-in-entra-passkey-windows.md).
173 +
165174 ## Related content
166175
167 −- [Enable passkeys (FIDO2) for your organization](how-to-authentication-passkeys-fido2.md)
176 +- [Enable passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-passkeys-fido2.md)
177 +- [Passkeys (FIDO2) authentication method in Microsoft Entra ID](concept-authentication-passkeys-fido2.md)
178 +- [Support for FIDO2 authentication with Microsoft Entra ID](concept-fido2-compatibility.md)
168179 - [Microsoft Entra ID attestation for FIDO2 authenticators](concept-fido2-hardware-vendor.md)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:34 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.