Passkey (FIDO2) authentication method
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 68a8f94 · +2 −2 lines · also on GitHub
⋯ 46 unchanged lines
4747
4848
**Attestation** verifies the authenticity of the passkey provider or device during registration. When enforced:
4949
50
−- It confirms the credential originates from a trusted authenticator.
51
−- Helps prevent spoofed AAGUIDs (Authenticator Attestation GUIDs) that could misrepresent device type.
50
+- It provides cryptographically verifiable device identity through FIDO Metadata Service (MDS). When attestation is enforced, relying parties can validate the authenticator model and apply policy decisions for certified devices.
51
+- Unattested passkeys, including synced passkeys and unattested device-bound passkeys, don't provide device provenance.
5252
5353
In Microsoft Entra ID:
5454
- Attestation can be enforced at the **passkey profile** level.
⋯ 9 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.