Entra passkeys on Windows

This page's changes and edits · All guidance changes

Microsoft's edit · 25 Mar 14:16 UTC

Change Entra passkeys on Windows to singular form

Microsoft's commit message in MicrosoftDocs/entra-docs · commit c68f276 · +21 ~~−21~~ lines · also on GitHub

11 ---

2 −title: Enable Microsoft Entra passkeys on Windows devices (preview)

3 −description: Learn how to enable Microsoft Entra passkeys on Windows devices for phishing-resistant multifactor authentication with work or school accounts.

2 +title: Enable Microsoft Entra passkey on Windows devices (preview)

3 +description: Learn how to enable Microsoft Entra passkey on Windows devices for phishing-resistantmultifactor authentication with work or school accounts.

44 #customer intent: As an administrator, I want to enable Microsoft Entra passkeys so users with work and school accounts can sign in by using phishing-resistant multifactor authentication.

55 author: hanki71

66 ms.author: justinha

⋯ 5 unchanged lines

1212 ms.custom: msecd-doc-authoring-106

1313 ---

1414

15 −# Enable Microsoft Entra passkeys on Windows (preview)

15 +# Enable Microsoft Entra passkey on Windows (preview)

1616

17 −This article describes Microsoft Entra passkeys on Windows in public preview. It covers how they work, how they differ from Windows Hello for Business, and how to configure passkey profiles to allow Windows Hello as a passkey provider.

17 +This article describes Microsoft Entra passkey on Windows in public preview. It covers how they work, how they differ from Windows Hello for Business, and how to configure passkey profiles to allow Windows Hello as a passkey provider.

1818

19 −Microsoft Entra passkeys on Windows are currently in public preview and require opt-in. You need to explicitly configure them to enable the preview of passkey registration in Windows Hello.

19 +Microsoft Entra passkey on Windows is currently in public preview and requires opt-in. You need to explicitly configure them to enable the preview of passkey registration in Windows Hello.

2020

2121 ## Overview

2222

23 −Microsoft Entra passkeys on Windows allow users to register passkeys (FIDO2) directly into their device's local Windows Hello container and use them to sign in to Microsoft Entra ID. Microsoft Entra passkeys on Windows enable phishing-resistant sign-in by using a Windows Hello biometric or PIN without requiring the device to be Microsoft Entra joined or registered.

23 +Microsoft Entra passkey on Windows allows users to register passkeys (FIDO2) directly into their device's local Windows Hello container and use them to sign in to Microsoft Entra ID. Microsoft Entra passkey on Windows enables phishing-resistant sign-in by using a Windows Hello biometric or PIN without requiring the device to be Microsoft Entra joined or registered.

2424

25 −By using Microsoft Entra passkeys on Windows:

25 +By using Microsoft Entra passkey on Windows:

2626

2727 - Users can register passkeys (FIDO2) in the local Windows Hello container.

2828 - Devices don't need to be joined or registered to Microsoft Entra to use a local Windows passkey.

2929 - A single Windows PC can store multiple passkeys for multiple Microsoft Entra accounts.

3030 - Passkeys (FIDO2) registered in Windows Hello are governed by Microsoft Entra passkey (FIDO2) policies and passkey profiles.

3131

32 −## How Microsoft Entra passkeys on Windows work

32 +## How Microsoft Entra passkey on Windows works

3333

3434 Windows Hello acts as a secure local credential container on Windows devices. The container is protected by user-presence verification such as:

3535

⋯ 1 unchanged line

3737 - Fingerprint

3838 - Facial recognition

3939

40 −Microsoft Entra passkeys on Windows allow passkeys (FIDO2) to be created and stored inside this Windows Hello container and used for authentication to Microsoft Entra ID.

40 +Microsoft Entra passkey on Windows allows passkeys (FIDO2) to be created and stored inside this Windows Hello container and used for authentication to Microsoft Entra ID.

4141

4242 This behavior also applies when the device is governed by Windows Hello for Business policies configured through Microsoft Intune. However, passkeys (FIDO2) are distinct from the Windows Hello for Business credentials that may be automatically registered during device registration to Microsoft Entra ID.

4343

⋯ 9 unchanged lines

5353

5454 These AAGUIDs represent Windows Hello passkey providers and are used in passkey profiles to allow or block registration.

5555

56 −## How Microsoft Entra passkeys on Windows compare with Windows Hello for Business

56 +## How Microsoft Entra passkey on Windows compares with Windows Hello for Business

5757

58 −Although both features use Windows Hello, Microsoft Entra passkeys on Windows and Windows Hello for Business have different purposes and behavior.

58 +Although both features use Windows Hello, Microsoft Entra passkey on Windows and Windows Hello for Business have different purposes and behavior.

5959

6060 ### Windows Hello for Business

6161

⋯ 5 unchanged lines

6767 - Windows Hello for Business is primarily a device-bound sign-in method linked to device trust.

6868 - Registration and authentication aren't controlled by the Microsoft Entra Authentication Methods Passkey (FIDO2) policy.

6969

70 −### Microsoft Entra passkeys on Windows

70 +### Microsoft Entra passkey on Windows

7171

72 −- Microsoft Entra passkeys on Windows are FIDO2 passkeys.

72 +- Microsoft Entra passkey on Windows is a FIDO2 passkey.

7373 - They can be registered without device join or registration.

7474 - Users can register multiple passkeys for multiple Microsoft Entra accounts on the same device.

7575 - Registration and authentication are controlled by using Microsoft Entra Authentication Methods Passkey (FIDO2) policy.

⋯ 13 unchanged lines

8989

9090 ## Attestation support

9191

92 −Attestation isn't supported for Microsoft Entra passkeys on Windows during public preview. As a result, if **Enforce attestation** is enabled in a passkey profile that allows Windows Hello AAGUIDs, passkey registration attempts to Windows Hello will fail.

92 +Attestation isn't supported for Microsoft Entra passkey on Windows during public preview. As a result, if **Enforce attestation** is enabled in a passkey profile that allows Windows Hello AAGUIDs, passkey registration attempts to Windows Hello will fail.

9393

9494 In the Authentication methods policy in the Microsoft Entra admin center, ensure that **Enforce attestation** is set to **No** for any passkey profile that includes Windows Hello AAGUIDs during public preview.

9595

9696 ## How to configure passkeys on Windows

9797

98 −During public preview, Microsoft Entra passkeys on Windows require an Authentication Policy Administrator to explicitly opt in.

98 +During public preview, Microsoft Entra passkey on Windows requires an Authentication Policy Administrator to explicitly opt in.

9999

100100 To enable registration, you need to meet all of the following prerequisites and configuration requirements.

101101

⋯ 15 unchanged lines

117117

118118 ## FAQ

119119

120 −**Question**: What is the use case for Microsoft Entra passkeys on Windows?

120 +**Question**: What is the use case for Microsoft Entra passkey on Windows?

121121

122 −**Answer**: Use Microsoft Entra passkeys on Windows when:

122 +**Answer**: Use Microsoft Entra passkey on Windows when:

123123

124124 - You want passkeys (FIDO2) stored locally on Windows.

125125 - Users access multiple Microsoft Entra accounts from a single PC.

126126 - You want standards-based, phishing-resistant sign-in to Microsoft Entra on unregistered, personal, or shared devices.

127127

128 −**Question**: Do Microsoft Entra passkeys on Windows replace Windows Hello for Business?

128 +**Question**: Does Microsoft Entra passkey on Windows replace Windows Hello for Business?

129129

130 −**Answer**: No. Microsoft Entra passkeys on Windows don't replace Windows Hello for Business. Windows Hello for Business remains the recommended solution for signing into corporate managed, Microsoft Entra joined or registered devices. Microsoft Entra passkeys on Windows complement Windows Hello for Business by enabling passkeys (FIDO2) on Windows in scenarios where devices aren't joined or registered. Microsoft Entra passkeys on Windows don't support device sign-in.

130 +**Answer**: No. Microsoft Entra passkey on Windows doesn't replace Windows Hello for Business. Windows Hello for Business remains the recommended solution for signing into corporate managed, Microsoft Entra joined or registered devices. Microsoft Entra passkey on Windows complements Windows Hello for Business by enabling passkeys (FIDO2) on Windows in scenarios where devices aren't joined or registered. Microsoft Entra passkey on Windows doesn't support device sign-in.

131131

132132 > [!NOTE]

133133 > Users can't register a passkey on Windows if a Windows Hello for Business credential already exists for the same account and container. This block may not apply once the user exceeds 50 total platform credentials.

134134

135135 **Question**: Are Microsoft Entra passkeys synced?

136136

137 −**Answer**: No. Microsoft Entra passkeys on Windows are device-bound and stored in the local Windows Hello container. They aren't synced across devices. Each device requires a separate passkey registration for each Microsoft Entra account.

137 +**Answer**: No. Microsoft Entra passkey on Windows is device-bound and stored in the local Windows Hello container. It isn't synced across devices. Each device requires a separate passkey registration for each Microsoft Entra account.

138138

139139 ## Known issues

140140

141 −During public preview, if a tenant allows Microsoft Entra passkeys on Windows and a user registers a passkey, it appears in the user's list of usable authentication methods in the Microsoft Entra admin center. If the tenant later removes the Windows Hello AAGUIDs from the allow list, the registered passkey remains on the usable authentication methods list instead of moving to the non-usable methods list. Although the passkey appears as usable, authentication with the passkey is governed by the current passkey (FIDO2) policy. If the Windows Hello AAGUIDs are no longer allowed, the passkey can't be used to authenticate. This display issue will be fixed for General Availability.

141 +During public preview, if a tenant allows Microsoft Entra passkey on Windows and a user registers a passkey, it appears in the user's list of usable authentication methods in the Microsoft Entra admin center. If the tenant later removes the Windows Hello AAGUIDs from the allow list, the registered passkey remains on the usable authentication methods list instead of moving to the non-usable methods list. Although the passkey appears as usable, authentication with the passkey is governed by the current passkey (FIDO2) policy. If the Windows Hello AAGUIDs are no longer allowed, the passkey can't be used to authenticate. This display issue will be fixed for General Availability.

142142

143143 ## Related content

144144

⋯ 2 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:50 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.