Passkey (FIDO2) authentication method
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 4016d4c · +3 −3 lines · also on GitHub
⋯ 40 unchanged lines
4141
- **Device-bound passkeys**: The private key is created and stored on a single physical device and never leaves it. Examples:
4242
- Microsoft Authenticator
4343
- FIDO2 Security keys
44
−- **Synced passkeys**: When created, the private key is stored in the secure element on the local device and also the passkey provider’s secure element on the cloud, it is then synced across devices that are signed-in to the same passkey provider account. This may differ depending on the provider. Synced passkeys do not support attestation. Examples:
45
− - [Apple iCloud Keychain](https://developer.apple.com/documentation/authenticationservices/public-private-key-authentication)
46
− - [Google Password Manager](https://developers.google.com/identity/passkeys#how-do-passkeys-work)
44
+- **Synced passkeys**: When created, the private key is created by a hardwear security module (HSM) and encrypted on the local device. This encrypted key is then synced to the cloud passkey provider with end to end encryption. Other devices registered with the passkey provider may then access the passkey. This may differ depending on the provider. Synced passkeys do not support attestation. Examples:
45
+ - [Apple iCloud Keychain](https://support.apple.com/en-us/102195)
46
+ - [Google Password Manager](https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html)
4747
4848
Synced passkeys offer a seamless and convenient user experience where users can use a device’s native unlock mechanism like face, fingerprint or PIN to authenticate. Based on the learnings from hundreds of millions of consumer users of Microsoft accounts that have registered and are using synced passkeys, we have learned:
4949
⋯ 33 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.