Passkeys and FIDO2
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit aff3c59 · +87 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: How to enable passkeys (FIDO2) in Microsoft Entra ID
3
+description: Learn how to enable passkeys (FIDO2) in Microsoft Entra ID.
4
+ms.topic: how-to
5
+ms.date: 03/08/2026
6
+author: hanki71
7
+ms.reviewer: kimhana
8
+ms.custom: sfi-ga-nochange, sfi-image-nochange
9
+# Customer intent: As a Microsoft Entra Administrator, I want to learn how to enable passkeys (FIDO2) in Microsoft Entra ID.
10
+---
11
+
12
+# How to enable passkeys (FIDO2) in Microsoft Entra ID
13
+
14
+Passkeys (FIDO2) are a strong, phishing-resistant alternative to passwords. Microsoft Entra ID supports synced passkeys. Synced passkeys are stored on the platform or with other passkey providers, such as Apple iCloud Keychain, Google Password Manager, 1Password, or Bitwarden, and are made available across a user’s devices. Synced passkeys simplify user onboarding and account recovery, which accelerates passwordless adoption for most organizations.
15
+
16
+## What are synced versus device-bound passkeys?
17
+
18
+Passkeys are FIDO2-based credentials that provide strong, phishing-resistant authentication. Microsoft Entra ID supports two main types of passkeys:
19
+
20
+- Device-bound passkeys: The private key is created and stored on a single physical device and never leaves it. Examples:
21
+ - Microsoft Authenticator (iOS)
22
+ - Microsoft Authenticator (Android)
23
+ - Security key
24
+- Synced passkeys: The private key is created by the hardware security module (HSM) and encrypted on the local device. This encrypted key is then synced and stored in the cloud passkey provider. Other devices authenticated with the passkey provider may then use the passkey. This may differ depending on the provider. Synced passkeys do not support attestation. Examples:
25
+ - [Apple iCloud Keychain](https://support.apple.com/en-us/102195)
26
+ - [Google Password Manager](https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html)
27
+
28
+> [!NOTE]
29
+> Treat synced passkeys as phishing-resistant credentials but with the same security posture as other unattested authenticators.
30
+
31
+## Requirements
32
+
33
+- Your organization must have [Passkey profiles](how-to-authentication-passkey-profiles.md) enabled.
34
+- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions.
35
+- The following table outlines the minimum device requirements for using synced passkeys. The columns represent the device platform where the user signs in.
36
+
37
+ Passkey provider | Windows | macOS | iOS | Android
38
+ -----------------|---------|-------|-----|--------
39
+ Apple Passwords (also called iCloud Keychain) | N/A | Natively built in. macOS 13+ | Natively built in. iOS 16+ | N/A
40
+ Google Password Manager | Built into Chrome | Built into Chrome | Built into Chrome. iOS 17+ | Natively built in (excluding Samsung devices). Android 9+
41
+ Other passkey providers (such as 1Password, Bitwarden) | Check for a browser extension | Check for a browser extension | Check for an app. iOS 17+ | Check for an app. Android 14+
42
+
43
+
44
+## Enable synced passkeys
45
+
46
+1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
47
+1. Make sure passkey profiles are enabled.
48
+1. Browse to **Entra ID** > **Security** > **Authentication methods** > **Policies**.
49
+1. Select **Passkey (FIDO2)** > **Configure**.
50
+1. Add a profile or edit an existing profile.
51
+1. Under **Passkey type**, select **Synced**, and then save the profile.
52
+
53
+
54
+> [!NOTE]
55
+> If you disable synced passkeys for a given passkey profile, targeted users can't sign in with a synced passkey even if they already registered one.
56
+
57
+## Delete a passkey (FIDO2)
58
+
59
+To remove a passkey (FIDO2) associated with a user account, delete it from the user's authentication method.
60
+
61
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) and search for the user whose passkey (FIDO2) needs to be removed.
62
+1. Select **Authentication methods** > right-click **Passkey (device-bound)** and select **Delete**.
63
+
64
+## Enforce passkey (FIDO2) sign-in
65
+
66
+To make users sign in with a passkey (FIDO2) when they access a sensitive resource, you can:
67
+
68
+- Use a built-in phishing-resistant authentication strength
69
+
70
+ Or
71
+
72
+- Create a custom authentication strength
73
+
74
+The following steps show how to create a custom authentication strength. It's a Conditional Access policy that allows passkey (FIDO2) sign-in for only a specific security key model or passkey (FIDO2) provider. For a list of FIDO2 providers, see [FIDO2 security keys eligible for attestation with Microsoft Entra ID](/entra/identity/authentication/concept-fido2-hardware-vendor).
75
+
76
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](../role-based-access-control/permissions-reference.md#conditional-access-administrator).
77
+1. Browse to **Entra ID** > **Authentication methods** > **Authentication strengths**.
78
+1. Select **New authentication strength**.
79
+1. Provide a **Name** for your new authentication strength.
80
+1. Optionally provide a **Description**.
81
+1. Select **Passkeys (FIDO2)**.
82
+1. Optionally, if you want to restrict a specific AAGUID, select **Advanced options** > **Add AAGUID**. Enter the AAGUID, and select **Save**.
83
+1. Choose **Next** and review the policy configuration.
84
+
85
+## Related content
86
+
87
+[How to enable passkey (FIDO2) profiles in Microsoft Entra ID](how-to-authentication-passkey-profiles.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 17:56 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.