Passkeys and FIDO2

This page's changes and edits · All guidance changes

Microsoft's edit · 19 Mar 22:10 UTC

Restructure passkeys article per review feedback

Microsoft's commit message in MicrosoftDocs/entra-docs · commit b693c91 · +47 ~~−39~~ lines · also on GitHub

⋯ 10 unchanged lines

1111

1212 # How to enable passkeys (FIDO2) in Microsoft Entra ID

1313

14 −Passkeys (FIDO2) are a strong, phishing-resistant alternative to passwords. Microsoft Entra ID supports synced passkeys. Synced passkeys are stored on the platform or with other passkey providers, such as Apple iCloud Keychain, Google Password Manager, 1Password, or Bitwarden, and are made available across a user’s devices. Synced passkeys simplify user onboarding and account recovery, which accelerates passwordless adoption for most organizations.

14 +For enterprises that use passwords today, passkeys (FIDO2) provide a seamless way for workers to authenticate without entering a username or password. Passkeys (FIDO2) provide improved productivity for workers, and have better security.

1515

16 −## What are synced versus device-bound passkeys?

16 +This article lists requirements and steps to enable passkeys in your organization. After you complete these steps, users in your organization can then register and sign in to their Microsoft Entra account using a passkey stored on a FIDO2 security key, a native or third-party passkey provider, or in Microsoft Authenticator.

1717

18 −Passkeys are FIDO2-based credentials that provide strong, phishing-resistant authentication. Microsoft Entra ID supports two main types of passkeys:

18 +For more information about enabling passkeys in Microsoft Authenticator, see [How to enable passkeys in Microsoft Authenticator](how-to-enable-authenticator-passkey.md).

1919

20 −- Device-bound passkeys: The private key is created and stored on a single physical device and never leaves it. Examples:

21 − - Microsoft Authenticator (iOS)

22 − - Microsoft Authenticator (Android)

23 − - Security key

24 −- Synced passkeys: The private key is created by the hardware security module (HSM) and encrypted on the local device. This encrypted key is then synced and stored in the cloud passkey provider. Other devices authenticated with the passkey provider may then use the passkey. This may differ depending on the provider. Synced passkeys do not support attestation. Examples:

25 − - [Apple iCloud Keychain](https://support.apple.com/en-us/102195)

26 − - [Google Password Manager](https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html)

20 +For more information about passkey authentication, see [Support for FIDO2 authentication with Microsoft Entra ID](~/identity/authentication/concept-fido2-compatibility.md).

2721

2822 > [!NOTE]

29 −> Treat synced passkeys as phishing-resistant credentials but with the same security posture as other unattested authenticators.

23 +> Microsoft Entra ID currently supports synced passkeys and device-bound passkeys stored on FIDO2 security keys and in Microsoft Authenticator. For more information, see [Passkeys (FIDO2) authentication method in Microsoft Entra ID](concept-authentication-passkeys-fido2.md).

3024

3125 ## Passkey (FIDO2) Authenticator Attestation GUID (AAGUID)

3226

⋯ 6 unchanged lines

3933

4034 ![Screenshot of how to view the AAGUID for a passkey.](media/how-to-enable-passkey-fido2/security-key-aaguid-details.png)

4135

42 −## Requirements

43 −

44 −- To enable synced passkeys, your organization must have [passkey profiles](#enable-passkey-profiles) enabled.

45 −- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions.

46 −- The following table outlines the minimum device requirements for using synced passkeys. The columns represent the device platform where the user signs in.

47 −

48 − Passkey provider | Windows | macOS | iOS | Android

49 − -----------------|---------|-------|-----|--------

50 − Apple Passwords (also called iCloud Keychain) | N/A | Natively built in. macOS 13+ | Natively built in. iOS 16+ | N/A

51 − Google Password Manager | Built into Chrome | Built into Chrome | Built into Chrome. iOS 17+ | Natively built in (excluding Samsung devices). Android 9+

52 − Other passkey providers (such as 1Password, Bitwarden) | Check for a browser extension | Check for a browser extension | Check for an app. iOS 17+ | Check for an app. Android 14+

53 −

54 −

5536 ## What are passkey profiles?

5637

5738 Passkey profiles enable granular group-based configurations for passkey (FIDO2) authentication. Instead of a single tenant-wide setting, you can define specific requirements such as attestation, passkey type (device-bound or synced), or Authenticator Attestation GUID (AAGUID) restrictions. You can apply requirements in separate passkey profiles for different user groups, such as admins versus frontline staff.

⋯ 118 unchanged lines

176157 All device-bound passkeys (excluding Microsoft Authenticator) | All users | Device-bound | Enabled | Enabled - Behavior: Block - AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android

177158 Passkeys in Microsoft Authenticator | Pilot group 1 Pilot group 2 | Device-bound | Enabled | Enabled - Behavior: Allow - AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android

178159

160 +## What are synced versus device-bound passkeys?

161 +

162 +Passkeys are FIDO2-based credentials that provide strong, phishing-resistant authentication. Microsoft Entra ID supports two main types of passkeys:

163 +

164 +- Device-bound passkeys: The private key is created and stored on a single physical device and never leaves it. Examples:

165 + - Microsoft Authenticator (iOS)

166 + - Microsoft Authenticator (Android)

167 + - Security key

168 +- Synced passkeys: The private key is created by the hardware security module (HSM) and encrypted on the local device. This encrypted key is then synced and stored in the cloud passkey provider. Other devices authenticated with the passkey provider may then use the passkey. This may differ depending on the provider. Synced passkeys do not support attestation. Examples:

169 + - [Apple iCloud Keychain](https://support.apple.com/en-us/102195)

170 + - [Google Password Manager](https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html)

171 +

172 +> [!NOTE]

173 +> Treat synced passkeys as phishing-resistant credentials but with the same security posture as other unattested authenticators.

174 +

175 +## Synced passkey requirements

176 +

177 +- To enable synced passkeys, your organization must have [passkey profiles](#enable-passkey-profiles) enabled.

178 +- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions.

179 +- The following table outlines the minimum device requirements for using synced passkeys. The columns represent the device platform where the user signs in.

180 +

181 + Passkey provider | Windows | macOS | iOS | Android

182 + -----------------|---------|-------|-----|--------

183 + Apple Passwords (also called iCloud Keychain) | N/A | Natively built in. macOS 13+ | Natively built in. iOS 16+ | N/A

184 + Google Password Manager | Built into Chrome | Built into Chrome | Built into Chrome. iOS 17+ | Natively built in (excluding Samsung devices). Android 9+

185 + Other passkey providers (such as 1Password, Bitwarden) | Check for a browser extension | Check for a browser extension | Check for an app. iOS 17+ | Check for an app. Android 14+

186 +

179187 ## Enable synced passkeys

180188

181189 1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).

⋯ 7 unchanged lines

189197 > [!NOTE]

190198 > If you disable synced passkeys for a given passkey profile, targeted users can't sign in with a synced passkey even if they already registered one.

191199

192 −## Provision FIDO2 security keys using Microsoft Graph API (preview)

193 −

194 −Currently in preview, administrators can use [Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users](https://aka.ms/passkeyprovision). Provisioning requires the [Authentication Administrator role](/entra/identity/role-based-access-control/permissions-reference#authentication-administrator) or a client application with UserAuthenticationMethod.ReadWrite.All permission. The provisioning improvements include:

195 −

196 −- The ability to request WebAuthn **creation Options** from Microsoft Entra ID

197 −- The ability to register the provisioned security key directly with Microsoft Entra ID

198 −

199 −With these new APIs, organizations can build their own clients to provision passkey (FIDO2) credentials on security keys on behalf of a user. To simplify this process, three main steps are required.

200 −

201 −1. **Request** creationOptions for a user: Microsoft Entra ID returns the necessary data for your client to provision a passkey (FIDO2) credential. This includes information such as user information, relying party ID, credential policy requirements, algorithms, registration challenge and more.

202 −2. **Provision** the passkey (FIDO2) credential with the creation Options: Use the `creationOptions` and a client that supports the Client to Authenticator Protocol (CTAP) to provision the credential. During this step, you need to insert the security key and set a PIN.

203 −3. **Register** the provisioned credential with Microsoft Entra ID: Use the formatted output from the provisioning process to provide Microsoft Entra ID the necessary data to register the passkey (FIDO2) credential for the targeted user.

204 −

205 −:::image type="content" border="true" source="media/how-to-enable-passkey-fido2/provision.png" alt-text="Conceptual diagram that shows the steps required to provision passkeys (FIDO2)." :::

206 −

207200 ## Delete a passkey (FIDO2)

208201

209202 To remove a passkey (FIDO2) associated with a user account, delete it from the user's authentication method.

⋯ 21 unchanged lines

231224 1. Select **Passkeys (FIDO2)**.

232225 1. Optionally, if you want to restrict a specific AAGUID, select **Advanced options** > **Add AAGUID**. Enter the AAGUID, and select **Save**.

233226 1. Choose **Next** and review the policy configuration.

227 +

228 +## Provision FIDO2 security keys using Microsoft Graph API (preview)

229 +

230 +Currently in preview, administrators can use [Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users](https://aka.ms/passkeyprovision). Provisioning requires the [Authentication Administrator role](/entra/identity/role-based-access-control/permissions-reference#authentication-administrator) or a client application with UserAuthenticationMethod.ReadWrite.All permission. The provisioning improvements include:

231 +

232 +- The ability to request WebAuthn **creation Options** from Microsoft Entra ID

233 +- The ability to register the provisioned security key directly with Microsoft Entra ID

234 +

235 +With these new APIs, organizations can build their own clients to provision passkey (FIDO2) credentials on security keys on behalf of a user. To simplify this process, three main steps are required.

236 +

237 +1. **Request** creationOptions for a user: Microsoft Entra ID returns the necessary data for your client to provision a passkey (FIDO2) credential. This includes information such as user information, relying party ID, credential policy requirements, algorithms, registration challenge and more.

238 +2. **Provision** the passkey (FIDO2) credential with the creation Options: Use the `creationOptions` and a client that supports the Client to Authenticator Protocol (CTAP) to provision the credential. During this step, you need to insert the security key and set a PIN.

239 +3. **Register** the provisioned credential with Microsoft Entra ID: Use the formatted output from the provisioning process to provide Microsoft Entra ID the necessary data to register the passkey (FIDO2) credential for the targeted user.

240 +

241 +:::image type="content" border="true" source="media/how-to-enable-passkey-fido2/provision.png" alt-text="Conceptual diagram that shows the steps required to provision passkeys (FIDO2)." :::

234242

235243 ## Known issues

236244

⋯ 15 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.