Passkeys and FIDO2
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit c5d139f · +140 −2 lines · also on GitHub
⋯ 40 unchanged lines
4141
4242
## Requirements
4343
44
−- Your organization must have [Passkey profiles](how-to-authentication-passkey-profiles.md) enabled.
44
+- Your organization must have [passkey profiles](#enable-passkey-profiles) enabled.
4545
- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions.
4646
- The following table outlines the minimum device requirements for using synced passkeys. The columns represent the device platform where the user signs in.
4747
⋯ 4 unchanged lines
5252
Other passkey providers (such as 1Password, Bitwarden) | Check for a browser extension | Check for a browser extension | Check for an app. iOS 17+ | Check for an app. Android 14+
5353
5454
55
+## What are passkey profiles?
56
+
57
+Passkey profiles enable granular group-based configurations for passkey (FIDO2) authentication. Instead of a single tenant-wide setting, you can define specific requirements such as attestation, passkey type (device-bound or synced), or Authenticator Attestation GUID (AAGUID) restrictions. You can apply requirements in separate passkey profiles for different user groups, such as admins versus frontline staff.
58
+
59
+> [!NOTE]
60
+> An Authentication Policy Administrator needs to configure a passkey profile to enable synced passkeys. For more information, see [How to enable synced passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-synced-passkeys.md).
61
+
62
+A passkey profile is a named set of policy rules that governs how users in targeted groups can register and authenticate with passkeys (FIDO2). Profiles support advanced controls such as:
63
+
64
+| Option | Configuration |
65
+|--------|---------------|
66
+| Enforce attestation | Enabled, Disabled |
67
+| Passkey types | Device-bound, Synced |
68
+| Target specific authenticators | Allow or block specific authenticators by their AAGUID. For more information, see [Authenticator Attestation GUID](#passkey-fido2-authenticator-attestation-guid-aaguid). |
69
+
70
+## Passkey profile prerequisites
71
+
72
+- Devices must support passkey (FIDO2) authentication. For Windows devices that are joined to Microsoft Entra ID, the best experience is on Windows 10 version 1903 or higher. Hybrid-joined devices must run Windows 10 version 2004 or higher.
73
+- If a passkey profile for both device-bound and synced passkeys targets Microsoft Authenticator, users need to run Microsoft Authenticator iOS version 6.8.37 or Android version 6.2507.4749.
74
+- Policy size limit:
75
+ - The Authentication methods policy supports a size limit of 20 KB. You can't save more passkey profiles after the size limit is reached. To check the size, use the [Get authenticationMethodsPolicy Microsoft Graph API](/graph/api/authenticationmethodspolicy-get) to retrieve the JSON for the Authentication methods policy. Save the output as a .txt file, then right-click and select **Properties** to view the file size.
76
+ - Reference sizes:
77
+ - Base passkey policy without changes: 1.44 KB
78
+ - Target with 1 applied passkey profile: 0.23 KB
79
+ - Target with 5 applied passkey profiles: 0.4 KB
80
+ - Passkey profile with no AAGUIDs: 0.4 KB
81
+ - Passkey profile with 10 AAGUIDs: 0.3 KB
82
+- Users must complete multifactor authentication (MFA) within the past five minutes before they can register a passkey (FIDO2).
83
+- Users need an authenticator that supports Microsoft Entra ID's attestation requirements. For more information, see [Microsoft Entra ID attestation for FIDO2 security key vendors](concept-fido2-hardware-vendor.md).
84
+
85
+## Enable passkey profiles
86
+
87
+> [!NOTE]
88
+> When you enable passkey profiles, your global passkey (FIDO2) policy settings automatically transfer to a **Default passkey profile**. Up to three passkey profiles, including the **Default passkey profile**, are supported. Support for more passkey profiles is in development.
89
+
90
+1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
91
+1. Browse to **Entra ID** > **Security** > **Authentication methods** > **Policies**.
92
+1. Select **Passkey (FIDO2)**. Select the link in the banner text to opt-in to using passkeys profiles.
93
+
94
+ > [!NOTE]
95
+ > After you opt in to enable passkey profiles, you can't opt out.
96
+
97
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/passkey-settings.png" alt-text="Screenshot that shows how to enable passkey profiles." lightbox="media/how-to-authentication-passkey-profiles/passkey-settings.png":::
98
+
99
+1. On the **Configure** tab, set **Allow self-service set up** to **Yes**. If set to **No**, users can't register a passkey by using [Security info](https://mysignins.microsoft.com/security-info), even if passkeys (FIDO2) are enabled by the Authentication methods policy. This setting is a global policy; it's not on the profile level.
100
+
101
+1. Select the **Default passkey profile**.
102
+
103
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/default-passkey-profile.png" alt-text="Screenshot that shows the default passkey profile." lightbox="media/how-to-authentication-passkey-profiles/default-passkey-profile.png":::
104
+
105
+ For **Passkey types**, select the types of passkeys that you want to allow.
106
+
107
+
108
+1. Select **Save**.
109
+
110
+## Create a new passkey profile
111
+
112
+1. On the **Configure** tab, select **+ Add passkey profile**.
113
+
114
+1. Fill in the profile details.
115
+
116
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-passkey-profile.png" alt-text="Screenshot that shows how to add a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-passkey-profile.png":::
117
+
118
+ >[!WARNING]
119
+ >- If you set **Enforce attestation** to **Yes**, attestation is required at registration time. Microsoft Entra ID can verify the authenticator's make and model against trusted metadata. Attestation assures your organization that the passkey is genuine and comes from the stated vendor. If enforce attestation is set to **No**, Microsoft Entra ID can't guarantee any attribute about a passkey, including if it's synced or device-bound.
120
+ >
121
+ >- Attestation enforcement governs whether a passkey (FIDO2) is allowed only during registration. Users who register a passkey (FIDO2) without attestation aren't blocked from sign-in if **Enforce attestation** is set to **Yes** later.
122
+
123
+ For other vendor attestation requirements, see [Microsoft Entra ID attestation for FIDO2 security key vendors](concept-fido2-hardware-vendor.md).
124
+
125
+ **Key Restriction Policy**
126
+
127
+ - **Enforce key restrictions** should be set to **Yes** only if your organization wants to only allow or disallow certain security key models or passkey providers, which are identified by their AAGUID. You can work with your security key vendor to determine the AAGUID of the passkey. If the passkey is already registered, you can find the AAGUID by viewing the authentication method details of the passkey for the user.
128
+
129
+ >[!WARNING]
130
+ >- Key restrictions set the usability of specific models or providers for both registration and authentication. If you change key restrictions and remove an AAGUID that you previously allowed, users who previously registered an allowed method can no longer use it for sign-in.
131
+ >- Use AAGUID lists as a policy guide rather than a strict security control when **Enforce attestation** is set to **No**.
132
+
133
+1. Select **Save**.
134
+
135
+## Apply a passkey profile to a targeted group
136
+
137
+1. Select **Enable and Target**.
138
+1. Select **Add target**, and then choose **All users** or **Select targets** to choose specific groups.
139
+
140
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-target.png" alt-text="Screenshot that shows how to add a target for a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-target.png":::
141
+
142
+1. Select the passkey profiles that you want to assign to a specific target.
143
+
144
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/select-passkey-profile.png" alt-text="Screenshot that shows how to select a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/select-passkey-profile.png":::
145
+
146
+ > [!NOTE]
147
+ > A target group (for example, Engineering) can be scoped for multiple passkey profiles. When a user is scoped for multiple passkey profiles, registration and authentication with a passkey are allowed if the passkey fully satisfies the requirements of at least one of the scoped passkey profiles. There's no particular order to the check. If a user is a member of an excluded group in the **Passkeys (FIDO2)** authentication method policy, they're blocked from FIDO2 passkey registration or sign-in entirely, and this takes precedence over them being in any **Included** groups.
148
+
149
+## Delete a passkey profile
150
+
151
+1. Select **Configure**.
152
+1. Select the delete icon next to the passkey profile that you want to delete, and then select **Save**.
153
+
154
+ > [!NOTE]
155
+ > You can delete a profile only if it's not assigned to a group of users in **Enable and target**. If the delete icon is unavailable, first remove any targets that are assigned that profile.
156
+
157
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/delete-passkey-profile.png" alt-text="Screenshot that shows how to delete a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/delete-passkey-profile.png":::
158
+
159
+## Examples of use cases for passkey profiles
160
+
161
+> [!NOTE]
162
+> If a passkey profile for both device-bound and synced passkeys targets Microsoft Authenticator, users need to run Microsoft Authenticator iOS version 6.8.37 or Android version 6.2507.4749.
163
+
164
+### Special consideration for high-privileged accounts
165
+
166
+Passkey profile | Target groups | Passkey types | Attestation enforcement | Key restrictions
167
+----------------|---------------|---------------|-------------------------|-----------------
168
+All device-bound passkeys (attestation enforced) | IT admins<br>Executives<br>Engineering | Device-bound | Enabled | Disabled
169
+All synced or device-bound passkeys | HR<br>Sales | Device-bound, Synced | Disabled | Disabled
170
+
171
+
172
+### Targeted rollout of passkeys in Microsoft Authenticator
173
+
174
+Passkey profile | Target groups | Passkey types | Attestation enforcement | Key restrictions
175
+----------------|---------------|---------------|-------------------------|-----------------
176
+All device-bound passkeys (excluding Microsoft Authenticator) | All users | Device-bound | Enabled | Enabled<br>- Behavior: Block<br>- AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android
177
+Passkeys in Microsoft Authenticator | Pilot group 1<br>Pilot group 2 | Device-bound | Enabled | Enabled<br>- Behavior: Allow<br>- AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android
178
+
55179
## Enable synced passkeys
56180
57181
1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
⋯ 50 unchanged lines
108232
1. Optionally, if you want to restrict a specific AAGUID, select **Advanced options** > **Add AAGUID**. Enter the AAGUID, and select **Save**.
109233
1. Choose **Next** and review the policy configuration.
110234
235
+## Known issues
236
+
237
+### Security key provisioning
238
+
239
+Administrator provisioning of security keys is in preview. See [Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users](https://aka.ms/passkeyprovision).
240
+
241
+### Guest users
242
+
243
+Registration of passkey (FIDO2) credentials isn't supported for internal or external guest users, including B2B collaboration users in the resource tenant.
244
+
245
+### UPN changes
246
+
247
+If a user's UPN changes, you can no longer modify passkeys (FIDO2) to account for the change. If the user has a passkey (FIDO2), they need to sign in to [Security info](https://mysignins.microsoft.com/security-info), delete the old passkey (FIDO2), and add a new one.
248
+
111249
## Related content
112250
113
−[How to enable passkey (FIDO2) profiles in Microsoft Entra ID](how-to-authentication-passkey-profiles.md)
251
+[How to enable synced passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-synced-passkeys.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.