Passkey (FIDO2) authentication method

This page's changes and edits · All guidance changes

Microsoft's edit · 6 Nov 2025 00:51 UTC

Update concept-authentication-passkeys-fido2.md

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7745db0 · +34 ~~−37~~ lines · also on GitHub

⋯ 3 unchanged lines

44 ms.service: entra-id

55 ms.subservice: authentication

66 ms.topic: concept-article

7 −ms.date: 10/31/2025

7 +ms.date: 11/05/2025

88 ms.author: justinha

99 author: justinha

1010 ms.reviewer: kimhana

⋯ 4 unchanged lines

1515

1616 # Authentication methods in Microsoft Entra ID - passkeys (FIDO2)

1717

18 −Passkeys (FIDO2) represent a modern, phishing-resistant authentication method that eliminates the need for passwords while providing enhanced security and improved user experience. Built on open standards from the FIDO Alliance and WebAuthn specification, passkeys use public key cryptography to create strong, unique credentials that are bound to specific websites and cannot be reused across different services.

19 −

20 −Microsoft Entra ID supports both device-bound passkeys, which are stored locally on hardware security keys or platform authenticators, and synced passkeys (preview), which are synchronized across devices through cloud-based passkey providers like iCloud Keychain and Google Password Manager. This dual approach allows organizations to implement passwordless authentication strategies that meet diverse security requirements while accommodating different user preferences and device ecosystems.

21 −

22 −## Device-bound passkeys

23 −

24 −Users can register a passkey (FIDO2) security key and choose it as their primary sign-in method. With a hardware device that handles the authentication, the security of an account is increased as there's no password that can be exposed or guessed. Currently in preview, an Authentication Administrator can also [provision a FIDO2 security](https://aka.ms/passkeyprovision) on behalf of a user by using Microsoft Graph API and a custom client. Provisioning on behalf of users is currently limited to security keys at this time.

25 −

26 −The FIDO (Fast IDentity Online) Alliance helps to promote open authentication standards and reduce the use of passwords as a form of authentication. FIDO2 is the latest standard that incorporates the web authentication (WebAuthn) standard. FIDO allows organizations to apply the WebAuthn standard by using an external security key, or a platform key built into a device, to sign in without a username or password.

27 −

28 −FIDO2 security keys are an unphishable standards-based passwordless authentication method that can come in any form factor. They're commonly USB devices, but they can also use Bluetooth or near-field communication (NFC). Passkeys (FIDO2) are based on the same WebAuthn standard and can be saved in Authenticator, or on mobile devices, tablets, or computers.

29 −

30 −FIDO2 security keys can be used to sign in to their Microsoft Entra ID or Microsoft Entra hybrid joined Windows 10 devices and get single-sign on to their cloud and on-premises resources. Users can also sign in to supported browsers. FIDO2 security keys are a great option for enterprises who are very security sensitive or have scenarios or employees who aren't willing or able to use their phone as a second factor.

31 −

32 −For more information about passkey (FIDO2) support, see [Support for passkey (FIDO2) authentication with Microsoft Entra ID](fido2-compatibility.md). For developer best practices, see [Support FIDO2 auth in the applications they develop](~/identity-platform/support-fido2-authentication.md).

33 −

34 −:::image type="content" border="true" source="./media/concept-authentication-passwordless/concept-web-sign-in-security-key.png" alt-text="Screenshot showing how to sign in to Microsoft Edge with a security key."lightbox="media/how-to-enable-authenticator-passkey/optional-settings.png":::

18 +Remote phishing attacks are on the rise. These attacks aim to steal or relay identity proofs—such as passwords, SMS codes, or email one-time passcodes—without physical access to the user’s device. Attackers often use social engineering, credential harvesting, or downgrade techniques to bypass stronger protections like passkeys or security keys. With AI-driven attack toolkits, these threats are becoming more sophisticated and scalable.

3519

20 +Passkeys help prevent remote phishing by replacing phishable methods like passwords, SMS, and email codes. Built on FIDO (Fast Identity Online) standards, passkeys use origin-bound public key cryptography, ensuring credentials can't be replayed or shared with malicious actors. In addition to stronger security, passkeys (FIDO2) offer a frictionless sign-in experience by eliminating passwords, reducing prompts, and enabling fast, secure authentication across devices.

3621

37 −The following process is used when a user signs in with a FIDO2 security key:

22 +Passkeys (FIDO2) can also be used to sign in to Microsoft Entra ID or Microsoft Entra hybrid joined Windows 11 devices and get single-sign on to cloud and on-premises resources.

3823

39 −:::image type="content" border="true" source="./media/concept-authentication-passwordless/fido2-security-key-flow.png" alt-text="Diagram that outlines the steps involved for user sign-in with a FIDO2 security key."lightbox="media/how-to-enable-authenticator-passkey/optional-settings.png":::

24 +## What Are Passkeys?

25 +Passkeys are phishing-resistant credentials that provide strong authentication and can serve as a multifactor authentication (MFA) method when combined with device biometrics or PIN. They also provide verifier impersonation resistance, which ensures an authenticator only releases secrets to the Relying Party (RP) the passkey was registered with and not an attacker pretending to be that RP. Passkeys (FIDO2) follow FIDO2 standards, using WebAuthn for browsers and CTAP for authenticator communication.

4026

41 −1. The user plugs the FIDO2 security key into their computer.

42 −2. Windows detects the FIDO2 security key.

43 −3. Windows sends an authentication request.

44 −4. Microsoft Entra ID sends back a nonce.

45 −5. The user completes their gesture to unlock the private key stored in the FIDO2 security key's secure enclave.

46 −6. The FIDO2 security key signs the nonce with the private key.

47 −7. The primary refresh token (PRT) token request with signed nonce is sent to Microsoft Entra ID.

48 −8. Microsoft Entra ID verifies the signed nonce using the FIDO2 public key.

49 −9. Microsoft Entra ID returns PRT to enable access to on-premises resources.

27 +The following process is used when a user signs in to Microsoft Entra ID with a passkey (FIDO2):

5028

51 −For a list of FIDO2 security key providers, see [Become a Microsoft-compatible FIDO2 security key vendor](concept-fido2-hardware-vendor.md). To get started with FIDO2 security keys, see [Enable passwordless sign using FIDO2 security keys](howto-authentication-passwordless-security-key.md).

29 +1. The user initiates sign-in to Microsoft Entra ID.

30 +1. The user selects a passkey:

31 + - Device-bound (stored on the device)

32 + - Cross-device (via QR code) or a FIDO2 security key

33 +1. Microsoft Entra ID sends a challenge (nonce) to the authenticator.

34 +1. The authenticator locates the key pair using the hashed RP ID and credential ID.

35 +1. The user performs a biometric or PIN gesture to unlock the private key.

36 +1. The authenticator signs the challenge with the private key and returns the signature.

37 +1. Microsoft Entra ID verifies the signature using the public key and issues a token.

5238

53 −## Synced passkeys (preview)

39 +## Types of passkeys

5440

55 −Synced passkeys represent a newer, more user-centric approach to authentication that removes the password entirely, works across devices by using services like iCloud Keychain, or Google Password Manager. Synced passkeys offer a seamless experience. Users authenticate with biometrics or device PINs. They don't need to remember or enter passwords or codes. Synced passkeys are built on the WebAuthn standard, where users verify their identity locally by using biometrics or device PINs. WebAuthn is supported across all major operating systems and browsers, including Windows, macOS, iOS, Android, Chrome, Safari, and Edge, which removes a key technical barrier and paves the way for broad, cross-platform adoption at scale.

41 +- Device-bound passkeys: The private key is created and stored on a single physical device and never leaves it. Examples:

42 + - Microsoft Authenticator

43 + - FIDO2 Security keys

44 +- Synced passkeys: The private key is stored in a passkey provider’s cloud and synced across devices signed-in to the same passkey provider account. Synced passkeys do not support attestation. Examples:

45 + - Apple iCloud Keychain

46 + - Google Password Manager

5647

57 −Admins can configure security groups for passkey authentication. Instead of a single tenant-wide setting, admins can customize requirements, such as attestation, passkey type (device-bound or synced), or a specific provider and model for their users, and apply them to different security groups in the enterprise. Enrollment campaigns can begin quickly.

48 +Attestation verifies the authenticity of the passkey provider or device during registration. When enforced:

5849

59 −## Unsupported scenarios

50 +- It confirms the credential originates from a trusted authenticator.

51 +- Helps prevent spoofed AAGUIDs (Authenticator Attestation GUIDs) that could misrepresent device type.

6052

61 −We recommend no more than 20 sets of keys for each passwordless method for any user account. As more keys are added, the user object size increases, and you could notice degradation for some operations. In that case, you should remove unnecessary keys.

53 +In Microsoft Entra ID:

54 +- Attestation can be enforced at the passkey profile level.

55 +- If attestation is enabled, only device-bound passkeys are allowed; synced passkeys are excluded.

6256

6357 ## Related content

6458

65 −- [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)

66 −- [Plan a Windows Hello for Business deployment](/windows/security/identity-protection/hello-for-business/deploy/)

59 +- [Enable passkeys (FIDO2) in Microsoft Entra ID](how-to-enable-passkey-fido2.md)

60 +- [Enable passkey profiles in Microsoft Entra ID](how-to-authentication-passkey-profiles.md)

61 +- [Enable synced passkeys in Microsoft Entra ID](how-to-authentication-synced-passkeys.md)

62 +- [Passkeys in Authenticator App](concept-authentication-authenticator-app.md#passkey-sign-in)

63 +- [Attestation requirements](concept-fido2-hardware-vendor.md#attestation-requirements)

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.