Passkey (FIDO2) authentication method
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 69a524c · +24 −3 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.service: entra-id
55
ms.subservice: authentication
66
ms.topic: concept-article
7
−ms.date: 11/05/2025
7
+ms.date: 11/10/2025
88
ms.author: justinha
99
author: justinha
1010
ms.reviewer: kimhana
⋯ 34 unchanged lines
4545
- Apple iCloud Keychain
4646
- Google Password Manager
4747
48
+Synced passkeys offer a seamless and convenient user experience where users can use a device’s native unlock mechanism like face, fingerprint or PIN to authenticate. Based on the learnings from hundreds of millions of consumer users of Microsoft accounts that have registered and are using synced passkeys, we have learnt:
49
+
50
+- **99% of users successfully register synced passkeys**
51
+- Synced passkeys are **14x faster compared to password and a traditional MFA combination: 3 seconds instead of 69 seconds**
52
+- Users are **3x more successful signing-in with synced passkey than legacy authentication methods (95% vs 30%)**
53
+- Synced passkeys in Microsoft Entra ID bring MFA simplicity at scale for all enterprise users. They're a convenient and low-cost alternative to traditional MFA options like SMS and authenticator apps.
54
+
55
+For more information about how to deploy passkeys in your organization, see [How to enable synced passkeys](how-to-authentication-synced-passkeys.md).
56
+
4857
**Attestation** verifies the authenticity of the passkey provider or device during registration. When enforced:
4958
50
−- It confirms the credential originates from a trusted authenticator.
51
−- Helps prevent spoofed AAGUIDs (Authenticator Attestation GUIDs) that could misrepresent device type.
59
+- It provides cryptographically verifiable device identity through FIDO Metadata Service (MDS). When attestation is enforced, relying parties can validate the authenticator model and apply policy decisions for certified devices.
60
+- Unattestaed passkeys, including synced passkeys and unattested device-bound passkeys, don’t provide device provenance.
5261
5362
In Microsoft Entra ID:
5463
- Attestation can be enforced at the **passkey profile** level.
5564
- If attestation is enabled, only device-bound passkeys are allowed; synced passkeys are excluded.
65
+
66
+## Choose the right passkey option
67
+
68
+FIDO2 security keys are recommended for highly regulated industries or users with elevated privileges. They provide strong security, but can increase costs for equipment, training, and helpdesk support—especially when users lose their physical keys and need account recovery.
69
+
70
+Passkeys in the Microsoft Authenticator app are another option for these user groups. However, current iOS and Android platform limitations may create usability challenges, leading to additional training and support costs.
71
+
72
+For most users—those outside highly regulated environments or without access to sensitive systems—**synced passkeys** offer a convenient, low-cost alternative to traditional MFA. Apple and Google have implemented advanced protections for passkeys stored in their clouds.
73
+
74
+Regardless of type—device-bound or synced—passkeys represent a significant security upgrade over phishable MFA methods.
75
+
76
+For more details, see [Get started with phishing-resistant MFA deployment in Microsoft Entra ID](how-to-plan-prerequisites-phishing-resistant-passwordless-authentication.md).
5677
5778
## Related content
5879
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.