Passkeys and FIDO2
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6442ddb · +15 −3 lines · also on GitHub
⋯ 19 unchanged lines
2020
For more information about passkey authentication, see [Support for FIDO2 authentication with Microsoft Entra ID](~/identity/authentication/concept-fido2-compatibility.md).
2121
2222
> [!NOTE]
23
−> Microsoft Entra ID currently supports synced passkeys and device-bound passkeys stored on FIDO2 security keys and in Microsoft Authenticator. For more information, see [Passkeys (FIDO2) authentication method in Microsoft Entra ID](concept-authentication-passkeys-fido2.md).
23
+> Microsoft Entra ID currently supports synced passkeys and device-bound passkeys stored on FIDO2 security keys and in Microsoft Authenticator. Passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free. No extra licenses are required. For more information, see [Passkeys (FIDO2) authentication method in Microsoft Entra ID](concept-authentication-passkeys-fido2.md).
2424
25
+## Get started
26
+
27
+To enable passkeys for your organization, complete these steps in order:
28
+
29
+1. **[Enable passkey profiles](#enable-passkey-profiles)** — Opt in to passkey profiles in the Microsoft Entra admin center. Your existing global settings transfer to a Default passkey profile.
30
+1. **[Create a passkey profile](#create-a-new-passkey-profile)** — Define attestation, passkey type (device-bound or synced), and key restriction settings for your target groups.
31
+1. **[Apply a passkey profile to a targeted group](#apply-a-passkey-profile-to-a-targeted-group)** — Assign your passkey profile to specific user groups or all users.
32
+1. **[Enable synced passkeys](#enable-synced-passkeys)** (optional) — If you want to allow synced passkeys, select **Synced** as a passkey type in your profile.
33
+1. **[Enforce passkey sign-in](#enforce-passkey-fido2-sign-in)** (optional) — Create a Conditional Access authentication strength policy to require passkeys for sensitive resources.
34
+
2535
## Passkey profiles
2636
2737
### What are passkey profiles?
⋯ 1 unchanged line
2939
Passkey profiles enable granular group-based configurations for passkey (FIDO2) authentication. Instead of a single tenant-wide setting, you can define specific requirements such as attestation, passkey type (device-bound or synced), or Authenticator Attestation GUID (AAGUID) restrictions. You can apply requirements in separate passkey profiles for different user groups, such as admins versus frontline staff.
3040
3141
> [!NOTE]
32
−> An Authentication Policy Administrator needs to configure a passkey profile to enable synced passkeys. For more information, see [How to enable synced passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-synced-passkeys.md).
42
+> An Authentication Policy Administrator needs to configure a passkey profile to enable synced passkeys. For more information, see [Enable synced passkeys](#enable-synced-passkeys).
3343
3444
A passkey profile is a named set of policy rules that governs how users in targeted groups can register and authenticate with passkeys (FIDO2). Profiles support advanced controls such as:
3545
⋯ 224 unchanged lines
260270
261271
## Related content
262272
263
−[How to enable synced passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-synced-passkeys.md)
273
+- [Passkeys (FIDO2) authentication method in Microsoft Entra ID](concept-authentication-passkeys-fido2.md)
274
+- [Support for FIDO2 authentication with Microsoft Entra ID](~/identity/authentication/concept-fido2-compatibility.md)
275
+- [How to enable passkeys in Microsoft Authenticator](how-to-enable-authenticator-passkey.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.