Passkey (FIDO2) authentication method

This page's changes and edits · All guidance changes

Microsoft's edit · 6 Nov 2025 00:54 UTC

Emphasize key terms in passkeys and FIDO2 documentation

Microsoft's commit message in MicrosoftDocs/entra-docs · commit e23bb6b · +6 −6 lines · also on GitHub

⋯ 16 unchanged lines

1717

1818 Remote phishing attacks are on the rise. These attacks aim to steal or relay identity proofs—such as passwords, SMS codes, or email one-time passcodes—without physical access to the user’s device. Attackers often use social engineering, credential harvesting, or downgrade techniques to bypass stronger protections like passkeys or security keys. With AI-driven attack toolkits, these threats are becoming more sophisticated and scalable.

1919

20 −Passkeys help prevent remote phishing by replacing phishable methods like passwords, SMS, and email codes. Built on FIDO (Fast Identity Online) standards, passkeys use origin-bound public key cryptography, ensuring credentials can't be replayed or shared with malicious actors. In addition to stronger security, passkeys (FIDO2) offer a frictionless sign-in experience by eliminating passwords, reducing prompts, and enabling fast, secure authentication across devices.

20 +Passkeys help prevent remote phishing by replacing phishable methods like passwords, SMS, and email codes. Built on **FIDO (Fast Identity Online) standards**, passkeys use origin-bound public key cryptography, ensuring credentials can't be replayed or shared with malicious actors. In addition to stronger security, passkeys (FIDO2) offer a frictionless sign-in experience by eliminating passwords, reducing prompts, and enabling fast, secure authentication across devices.

2121

2222 Passkeys (FIDO2) can also be used to sign in to Microsoft Entra ID or Microsoft Entra hybrid joined Windows 11 devices and get single-sign on to cloud and on-premises resources.

2323

2424 ## What Are Passkeys?

25 −Passkeys are phishing-resistant credentials that provide strong authentication and can serve as a multifactor authentication (MFA) method when combined with device biometrics or PIN. They also provide verifier impersonation resistance, which ensures an authenticator only releases secrets to the Relying Party (RP) the passkey was registered with and not an attacker pretending to be that RP. Passkeys (FIDO2) follow FIDO2 standards, using WebAuthn for browsers and CTAP for authenticator communication.

25 +Passkeys are phishing-resistant credentials that provide **strong authentication** and can serve as a **multifactor authentication (MFA)** method when combined with device biometrics or PIN. They also provide verifier impersonation resistance, which ensures an authenticator only releases secrets to the Relying Party (RP) the passkey was registered with and not an attacker pretending to be that RP. Passkeys (FIDO2) follow FIDO2 standards, using WebAuthn for browsers and CTAP for authenticator communication.

2626

2727 The following process is used when a user signs in to Microsoft Entra ID with a passkey (FIDO2):

2828

⋯ 9 unchanged lines

3838

3939 ## Types of passkeys

4040

41 −- Device-bound passkeys: The private key is created and stored on a single physical device and never leaves it. Examples:

41 +- **Device-bound passkeys**: The private key is created and stored on a single physical device and never leaves it. Examples:

4242 - Microsoft Authenticator

4343 - FIDO2 Security keys

44 −- Synced passkeys: The private key is stored in a passkey provider’s cloud and synced across devices signed-in to the same passkey provider account. Synced passkeys do not support attestation. Examples:

44 +- **Synced passkeys**: The private key is stored in a passkey provider’s cloud and synced across devices signed-in to the same passkey provider account. Synced passkeys do not support attestation. Examples:

4545 - Apple iCloud Keychain

4646 - Google Password Manager

4747

48 −Attestation verifies the authenticity of the passkey provider or device during registration. When enforced:

48 +**Attestation** verifies the authenticity of the passkey provider or device during registration. When enforced:

4949

5050 - It confirms the credential originates from a trusted authenticator.

5151 - Helps prevent spoofed AAGUIDs (Authenticator Attestation GUIDs) that could misrepresent device type.

5252

5353 In Microsoft Entra ID:

54 −- Attestation can be enforced at the passkey profile level.

54 +- Attestation can be enforced at the **passkey profile** level.

5555 - If attestation is enabled, only device-bound passkeys are allowed; synced passkeys are excluded.

5656

5757 ## Related content

⋯ 6 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.