FIDO2 security key Windows sign-in
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 14f5948 · +104 −33 lines · also on GitHub
11
---
22
title: FIDO2 security key sign-in to Windows
3
−description: Learn how to enable passwordless security key sign-in to Windows with Microsoft Entra ID using FIDO2 security keys.
3
+description: Learn how to enable passwordless security key sign-in to Windows with Microsoft Entra ID using FIDO2 security keys.
44
ms.topic: how-to
5
−ms.date: 03/04/2025
5
+ms.date: 07/05/2026
66
ms.reviewer: librown, aakapo
7
+ms.custom: msecd-doc-authoring-1013
8
+ai-usage: ai-assisted
79
---
8
−# Enable FIDO2 security key sign-in to Windows 10 and 11 devices with Microsoft Entra ID
10
+# Enable FIDO2 security key sign-in to Windows 10 and 11 devices with Microsoft Entra ID
911
10
−This document focuses on enabling FIDO2 security key based passwordless authentication with Windows 10 and 11 devices. After completing the steps in this article, you're able to sign in to both your Microsoft Entra ID and Microsoft Entra hybrid joined Windows devices with your Microsoft Entra account using a FIDO2 security key.
12
+This article focuses on enabling FIDO2 security key-based passwordless authentication with Windows 10 and 11 devices. After completing the steps in this article, you can sign in to both your Microsoft Entra ID and Microsoft Entra hybrid joined Windows devices with your Microsoft Entra account using a FIDO2 security key.
1113
12
−## Requirements
14
+## Prerequisites for FIDO2 security keys
1315
14
−| Device Type | Microsoft Entra joined | Microsoft Entra hybrid joined |
15
−| --- | --- | --- |
16
−| [Microsoft Entra multifactor authentication](howto-mfa-getstarted.md) | X | X |
17
−| [Combined security information registration](concept-registration-mfa-sspr-combined.md) | X | X |
18
−| Compatible [FIDO2 security keys](concept-authentication-passkeys-fido2.md) | X | X |
19
−| WebAuthN requires Windows 10 version 1903 or higher | X | X |
20
−| [Microsoft Entra joined devices](~/identity/devices/concept-directory-join.md) require Windows 10 version 1909 or higher | X | |
21
−| [Microsoft Entra hybrid joined devices](~/identity/devices/concept-hybrid-join.md) require Windows 10 version 2004 or higher | | X |
22
−| Fully patched Windows Server 2016/2019 Domain Controllers. | | X |
23
−| [Microsoft Entra Hybrid Authentication Management module](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.1.1.0) | | X |
24
−| [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (Optional) | X | X |
25
−| Provisioning package (Optional) | X | X |
26
−| Group Policy (Optional) | | X |
16
+- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions to configure authentication methods.
17
+- You need to [enable passkey sign-in](how-to-authentication-passkeys-fido2.md#enable-passkey-profiles) in the **Passkey (FIDO2)** policy in **Authentication methods** in the Microsoft Entra admin center.
18
+- Devices need to meet the following requirements:
2719
20
+ | Device Type | Microsoft Entra joined | Microsoft Entra hybrid joined |
21
+ | --- | --- | --- |
22
+ | Compatible [FIDO2 security keys](concept-authentication-passkeys-fido2.md) | X | X |
23
+ | WebAuthN requires Windows 10 version 1903 or higher | X | X |
24
+ | [Microsoft Entra joined devices](~/identity/devices/concept-directory-join.md) require Windows 10 version 1909 or higher | X | |
25
+ | [Microsoft Entra hybrid joined devices](~/identity/devices/concept-hybrid-join.md) require Windows 10 version 2004 or higher | | X |
26
+ | Fully patched domain controllers that run Windows Server 2016 or later | | X |
27
+ | [Microsoft Entra Hybrid Authentication Management module](https://www.powershellgallery.com/packages/AzureADHybridAuthenticationManagement/2.1.1.0) | | X |
28
+ | [Microsoft Intune](/mem/intune/fundamentals/what-is-intune) (Optional) | X | X |
29
+ | Provisioning package (Optional) | X | X |
30
+ | Group Policy (Optional) | | X |
31
+
2832
### Unsupported scenarios
2933
3034
The following scenarios aren't supported:
3135
3236
- Windows Server Active Directory Domain Services (AD DS) domain-joined (on-premises only devices) deployment.
33
−- Scenarios, such as RDP, VDI, and Citrix, that use a security key other than [webauthn redirection](/azure/virtual-desktop/authentication).
37
+- Scenarios such as RDP, VDI, and Citrix, that use a security key other than [webauthn redirection](/azure/virtual-desktop/authentication).
3438
- S/MIME using a security key.
3539
- *Run as* using a security key.
3640
- Signing in to a server using a security key.
41
+
3742
### Device sign-in and unlock
3843
39
−- OOBE sign-in with a passkey is supported. You can use Web sign-in to unlock a Windows device. For more information, see [Use Web Sign-In To Enable Passwordless Sign-In In Windows](/windows/security/identity-protection/web-sign-in).
44
+- OOBE sign-in with a FIDO2 security key is supported. You can use Web sign-in to unlock a Windows device. For more information, see [Use Web Sign-In To Enable Passwordless Sign-In In Windows](/windows/security/identity-protection/web-sign-in).
4045
- When signing in or unlocking a Windows device using a security key that contains multiple Microsoft Entra accounts, the device defaults to the last account added to the key. However, WebAuthn allows users to select the specific account they wish to use for authentication.
4146
- Unlocking a device requires Windows 10 version 1809. For the best experience, use Windows 10 version 1903 or higher.
4247
⋯ 3 unchanged lines
4651
4752
Microsoft Entra hybrid joined devices must run Windows 10 version 2004 or newer.
4853
49
−## Enable security keys for Windows sign-in
54
+## Configure a device-bound passkeys profile for FIDO2 security keys
5055
56
+A device-bound key profile allows you to define attestation and key restriction settings for device-bound passkeys stored on physical security keys.
57
+
58
+1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
59
+1. Browse to **Entra ID** > **Authentication methods**.
60
+1. On the **Authentication methods | Policies** page, select **Passkey (FIDO2)** > **Configure**.
61
+1. Select **+ Add profile**.
62
+
63
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-passkey-profile.png" alt-text="Screenshot that shows how to add a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-passkey-profile.png":::
64
+
65
+1. Enter a **Name** for the profile, such as **FIDO2 security keys**.
66
+1. For **Passkey types**, select **Device-bound** and **Save**.
67
+
68
+ > [!NOTE]
69
+ > If you disable device-bound passkeys for a given passkey profile, targeted users can't sign in with a device-bound passkey even if they already registered one.
70
+
71
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/security-key-profile.png" alt-text="Screenshot that shows a passkey profile named FIDO2 security keys with Passkey types set to Device-bound." lightbox="media/how-to-authentication-passkey-profiles/security-key-profile.png":::
72
+
73
+### Example: Target specific AAGUIDs
74
+
75
+You can target specific AAGUIDs to control which authenticators users can register. In this example, the passkey profile allows only AAGUIDs for specific models of FIDO2 security keys.
76
+
77
+To configure this profile:
78
+
79
+1. Select **Target specific AAGUIDs**.
80
+1. Set **Behavior** to **Allow**.
81
+1. Under **Model/Provider AAGUIDs**, add the AAGUIDs for the FIDO2 security key models that you want to allow for sign-in, and select **Save**.
82
+
83
+ >[!WARNING]
84
+ >- If you select **Enforce attestation**, attestation is required at registration time. Microsoft Entra ID can verify the authenticator's make and model against trusted metadata. Attestation assures your organization that the passkey is genuine and comes from the stated vendor. If you don't select **Enforce attestation**, Microsoft Entra ID can't guarantee any attribute about a passkey, including if it's synced or device-bound.
85
+ >
86
+ >- Attestation enforcement governs whether a passkey (FIDO2) is allowed only during registration. Users who register a passkey (FIDO2) without attestation aren't blocked from sign-in if **Enforce attestation** is selected later.
87
+
88
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/security-key-high-assurance-profile.png" alt-text="Screenshot that shows a passkey profile named FIDO2 security keys with Enforce attestation and Target specific AAGUIDs selected, Behavior set to Allow, and specific FIDO2 security key model AAGUIDs added." lightbox="media/how-to-authentication-passkey-profiles/security-key-high-assurance-profile.png":::
89
+
90
+## Enable and target groups for a device-bound passkey profile
91
+
5192
Organizations can choose to use one or more of the following methods to enable the use of security keys for Windows sign-in based on their organization's requirements:
5293
94
+- [Enable with Microsoft Entra admin center](#enable-with-microsoft-entra-admin-center)
5395
- [Enable with Microsoft Intune](#enable-with-microsoft-intune)
5496
- [Targeted Microsoft Intune deployment](#targeted-intune-deployment)
5597
- [Enable with a provisioning package](#enable-with-a-provisioning-package)
⋯ 4 unchanged lines
60102
>
61103
> Organizations with **Microsoft Entra joined devices** must do this before their devices can authenticate to on-premises resources with FIDO2 security keys.
62104
105
+### Enable with Microsoft Entra admin center
106
+
107
+1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
108
+1. Browse to **Entra ID** > **Authentication methods**.
109
+1. On the **Authentication methods | Policies** page, select **Passkey (FIDO2)** > **Enable and target**.
110
+1. On the **Enable and Target** tab, make sure **Enable** is **On**.
111
+1. Select **Add target**, and choose **All users** or **Select targets** to choose specific groups.
112
+
113
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-target.png" alt-text="Screenshot that shows how to add a target for a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-target.png":::
114
+
115
+1. Select the profile for device-bound passkeys.
116
+
117
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/enable-target-device-bound.png" alt-text="Screenshot that shows how to enable and target a profile for device-bound passkeys." lightbox="media/how-to-authentication-passkey-profiles/enable-target-device-bound.png":::
118
+
119
+1. Select **Save** to enable device-bound passkeys for the selected users.
120
+
63121
### Enable with Microsoft Intune
64122
65123
To enable the use of security keys using Intune, complete the following steps:
⋯ 5 unchanged lines
71129
Configuration of security keys for sign-in isn't dependent on configuring Windows Hello for Business.
72130
73131
> [!NOTE]
74
−> This will not enable security keys on already provisioned devices. In that case use the next method (Targeted Intune deployment)
132
+> This doesn't enable security keys on already provisioned devices. In that case, use the next method (Targeted Intune deployment).
75133
76134
### Targeted Intune deployment
77135
⋯ 46 unchanged lines
124182
125183
This Group Policy setting requires an updated version of the `CredentialProviders.admx` Group Policy template. This new template is available with the next version of Windows Server and with Windows 10 20H1. This setting can be managed with a device running one of these newer versions of Windows or centrally by following the guidance here: [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra).
126184
127
−## Sign in with FIDO2 security key
185
+## Provision FIDO2 security keys using Microsoft Graph API (preview)
128186
129
−In this example, a user named Bala Sandhu already provisioned their FIDO2 security key using the steps in the previous article, [Enable passwordless security key sign in](howto-authentication-passwordless-security-key.md#user-registration-and-management-of-fido2-security-keys). For Microsoft Entra hybrid joined devices, make sure you also [enabled passwordless security key sign-in to on-premises resources](howto-authentication-passwordless-security-key-on-premises.md). Bala can choose the security key credential provider from the Windows 10 lock screen and insert the security key to sign into Windows.
187
+Currently in preview, administrators can use [Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users](https://aka.ms/passkeyprovision). Provisioning requires the [Authentication Administrator role](/entra/identity/role-based-access-control/permissions-reference#authentication-administrator) or a client application with UserAuthenticationMethod.ReadWrite.All permission. The provisioning improvements include:
130188
131
−
189
+- The ability to request WebAuthn **creation Options** from Microsoft Entra ID
190
+- The ability to register the provisioned security key directly with Microsoft Entra ID
132191
133
−### Manage security key biometric, PIN, or reset security key
192
+With these new APIs, organizations can build their own clients to provision passkey (FIDO2) credentials on security keys on behalf of a user. To simplify this process, three main steps are required.
134193
135
−* Windows 10 version 1903 or higher
136
− * On a device, users can go to **Windows Settings** > **Accounts** > **Sign-in options** > **Security Key**, and then select the **Manage** button.
137
− * Users can change their PIN, update biometrics, or reset their security key
194
+1. **Request** creationOptions for a user: Microsoft Entra ID returns the necessary data for your client to provision a passkey (FIDO2) credential. This includes information such as user information, relying party ID, credential policy requirements, algorithms, registration challenge and more.
195
+1. **Provision** the passkey (FIDO2) credential with the creation Options: Use the `creationOptions` and a client that supports the Client to Authenticator Protocol (CTAP) to provision the credential. During this step, you need to insert the security key and set a PIN.
196
+1. **Register** the provisioned credential with Microsoft Entra ID: Use the formatted output from the provisioning process to provide Microsoft Entra ID the necessary data to register the passkey (FIDO2) credential for the targeted user.
138197
198
+:::image type="content" border="true" source="media/how-to-enable-passkey-fido2/provision.png" alt-text="Diagram that shows the steps to provision passkeys (FIDO2)." :::
199
+
139200
## Troubleshooting and feedback
140201
141202
If you'd like to share feedback or encounter issues about this feature, share via the Windows Feedback Hub app using the following steps:
⋯ 4 unchanged lines
146207
- Subcategory: FIDO
147208
1. To capture logs, use the option to **Recreate my Problem**.
148209
149
−## Next steps
210
+## Register a FIDO2 security key
150211
151
−[Enable access to on-premises resources for Microsoft Entra ID and Microsoft Entra hybrid joined devices](howto-authentication-passwordless-security-key-on-premises.md)
212
+After an admin creates the device-bound passkey profile, users can register a FIDO2 security key on their device.
152213
153
−[Learn more about device registration](~/identity/devices/overview.md)
214
+For registration steps, see [Register a passkey with a FIDO2 security key](how-to-register-passkey-with-security-key.md).
154215
155
−[Learn more about Microsoft Entra multifactor authentication](~/identity/authentication/howto-mfa-getstarted.md)
216
+## Sign in with a FIDO2 security key
217
+
218
+After registration, users can sign in to Microsoft Entra ID by using the FIDO2 security key on their device.
219
+
220
+For sign-in steps, see [Sign in with a FIDO2 security key](how-to-security-key-sign-in.md).
221
+
222
+## Related content
223
+
224
+- [Enable access to on-premises resources for Microsoft Entra ID and Microsoft Entra hybrid joined devices](howto-authentication-passwordless-security-key-on-premises.md)
225
+- [Device registration overview](~/identity/devices/overview.md)
226
+- [Microsoft Entra multifactor authentication](~/identity/authentication/howto-mfa-getstarted.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:44 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.