Passkey (FIDO2) authentication method
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit d408591 · +9 −12 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.service: entra-id
55
ms.subservice: authentication
66
ms.topic: concept-article
7
−ms.date: 10/26/2025
7
+ms.date: 10/31/2025
88
ms.author: justinha
99
author: justinha
1010
ms.reviewer: kimhana
⋯ 4 unchanged lines
1515
1616
# Authentication methods in Microsoft Entra ID - passkeys (FIDO2)
1717
18
+Passkeys (FIDO2) represent a modern, phishing-resistant authentication method that eliminates the need for passwords while providing enhanced security and improved user experience. Built on open standards from the FIDO Alliance and WebAuthn specification, passkeys use public key cryptography to create strong, unique credentials that are bound to specific websites and cannot be reused across different services.
1819
20
+Microsoft Entra ID supports both device-bound passkeys, which are stored locally on hardware security keys or platform authenticators, and synced passkeys (preview), which are synchronized across devices through cloud-based passkey providers like iCloud Keychain and Google Password Manager. This dual approach allows organizations to implement passwordless authentication strategies that meet diverse security requirements while accommodating different user preferences and device ecosystems.
1921
2022
## Device-bound passkeys
2123
⋯ 7 unchanged lines
2931
3032
For more information about passkey (FIDO2) support, see [Support for passkey (FIDO2) authentication with Microsoft Entra ID](fido2-compatibility.md). For developer best practices, see [Support FIDO2 auth in the applications they develop](~/identity-platform/support-fido2-authentication.md).
3133
32
−
34
+:::image type="content" border="true" source="./media/concept-authentication-passwordless/concept-web-sign-in-security-key.png" alt-text="Screenshot showing how to sign in to Microsoft Edge with a security key."lightbox="media/how-to-enable-authenticator-passkey/optional-settings.png":::
3335
36
+
3437
The following process is used when a user signs in with a FIDO2 security key:
3538
36
−
39
+:::image type="content" border="true" source="./media/concept-authentication-passwordless/fido2-security-key-flow.png" alt-text="Diagram that outlines the steps involved for user sign-in with a FIDO2 security key."lightbox="media/how-to-enable-authenticator-passkey/optional-settings.png":::
3740
3841
1. The user plugs the FIDO2 security key into their computer.
3942
2. Windows detects the FIDO2 security key.
⋯ 5 unchanged lines
4548
8. Microsoft Entra ID verifies the signed nonce using the FIDO2 public key.
4649
9. Microsoft Entra ID returns PRT to enable access to on-premises resources.
4750
48
−For a list of FIDO2 security key providers, see [Become a Microsoft-compatible FIDO2 security key vendor](concept-fido2-hardware-vendor.md).
49
−
50
−To get started with FIDO2 security keys, see [Enable passwordless sign using FIDO2 security keys](howto-authentication-passwordless-security-key.md).
51
+For a list of FIDO2 security key providers, see [Become a Microsoft-compatible FIDO2 security key vendor](concept-fido2-hardware-vendor.md). To get started with FIDO2 security keys, see [Enable passwordless sign using FIDO2 security keys](howto-authentication-passwordless-security-key.md).
5152
5253
## Synced passkeys (preview)
5354
54
−Synced passkeys represent a newer, more user-centric approach to authentication that removes the password entirely, works across devices by using services like iCloud Keychain, or Google Password Manager. Synced passkeys offer a seamless experience. Users authenticate with biometrics or device PINs. The don't need to remember or enter passwords or codes. Synced passkeys are built on the WebAuthn standard, where users verify their identity locally by using biometrics or device PINs. WebAuthn is supported across all major operating systems and browsers, including Windows, macOS, iOS, Android, Chrome, Safari, and Edge, which removes a key technical barrier and paves the way for broad, cross-platform adoption at scale.
55
−
56
−Admins can configure security groups for passkey authentication. Instead of a single tenant-wide setting, admins can customize requirements, such as attestation, passkey type (device-bound or synced), or a specific provider and model for their users, and apply them to different security groups in the enterprise. Enrollment campaigns can begin quickly.
57
−
58
−## Compare device-bound passkeys with synced passkeys
55
+Synced passkeys represent a newer, more user-centric approach to authentication that removes the password entirely, works across devices by using services like iCloud Keychain, or Google Password Manager. Synced passkeys offer a seamless experience. Users authenticate with biometrics or device PINs. They don't need to remember or enter passwords or codes. Synced passkeys are built on the WebAuthn standard, where users verify their identity locally by using biometrics or device PINs. WebAuthn is supported across all major operating systems and browsers, including Windows, macOS, iOS, Android, Chrome, Safari, and Edge, which removes a key technical barrier and paves the way for broad, cross-platform adoption at scale.
5956
60
−## Common AAGUIDs for each type of passkey
57
+Admins can configure security groups for passkey authentication. Instead of a single tenant-wide setting, admins can customize requirements, such as attestation, passkey type (device-bound or synced), or a specific provider and model for their users, and apply them to different security groups in the enterprise. Enrollment campaigns can begin quickly.
6158
6259
## Unsupported scenarios
6360
⋯ 6 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.