Passkeys and FIDO2
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f2cc7c5 · +44 −40 lines · also on GitHub
⋯ 21 unchanged lines
2222
> [!NOTE]
2323
> Microsoft Entra ID currently supports synced passkeys and device-bound passkeys stored on FIDO2 security keys and in Microsoft Authenticator. For more information, see [Passkeys (FIDO2) authentication method in Microsoft Entra ID](concept-authentication-passkeys-fido2.md).
2424
25
−## Passkey (FIDO2) Authenticator Attestation GUID (AAGUID)
26
−
27
−The FIDO2 specification requires each security key vendor to provide an Authenticator Attestation GUID (AAGUID) during registration. An AAGUID is a 128-bit identifier indicating the key type, such as the make and model. Passkey (FIDO2) providers on desktop and mobile devices are also expected to provide an AAGUID during registration.
28
−
29
−>[!NOTE]
30
−>The vendor must ensure that the AAGUID is identical across all substantially identical security keys or passkey (FIDO2) providers made by that vendor, and different (with high probability) from the AAGUIDs of all other types of security keys or passkey (FIDO2) providers. To ensure this, the AAGUID for a given security key model or passkey (FIDO2) provider should be randomly generated. For more information, see [Web Authentication: An API for accessing Public Key Credentials - Level 2 (w3.org)](https://w3c.github.io/webauthn/).
31
−
32
−You can work with your security key vendor to determine the AAGUID of the passkey (FIDO2), or see [FIDO2 security keys eligible for attestation with Microsoft Entra ID](~/identity/authentication/concept-fido2-hardware-vendor.md#fido2-security-keys-eligible-for-attestation-with-microsoft-entra-id). If the passkey (FIDO2) is already registered, you can find the AAGUID by viewing the authentication method details of the passkey (FIDO2) for the user.
33
−
34
−
25
+## Passkey profiles
3526
36
−## What are passkey profiles?
27
+### What are passkey profiles?
3728
3829
Passkey profiles enable granular group-based configurations for passkey (FIDO2) authentication. Instead of a single tenant-wide setting, you can define specific requirements such as attestation, passkey type (device-bound or synced), or Authenticator Attestation GUID (AAGUID) restrictions. You can apply requirements in separate passkey profiles for different user groups, such as admins versus frontline staff.
3930
⋯ 8 unchanged lines
4839
| Passkey types | Device-bound, Synced |
4940
| Target specific authenticators | Allow or block specific authenticators by their AAGUID. For more information, see [Authenticator Attestation GUID](#passkey-fido2-authenticator-attestation-guid-aaguid). |
5041
51
−## Passkey profile prerequisites
42
+### Examples of use cases for passkey profiles
5243
44
+> [!NOTE]
45
+> If a passkey profile for both device-bound and synced passkeys targets Microsoft Authenticator, users need to run Microsoft Authenticator iOS version 6.8.37 or Android version 6.2507.4749.
46
+
47
+#### Special consideration for high-privileged accounts
48
+
49
+Passkey profile | Target groups | Passkey types | Attestation enforcement | Key restrictions
50
+----------------|---------------|---------------|-------------------------|-----------------
51
+All device-bound passkeys (attestation enforced) | IT admins<br>Executives<br>Engineering | Device-bound | Enabled | Disabled
52
+All synced or device-bound passkeys | HR<br>Sales | Device-bound, Synced | Disabled | Disabled
53
+
54
+
55
+#### Targeted rollout of passkeys in Microsoft Authenticator
56
+
57
+Passkey profile | Target groups | Passkey types | Attestation enforcement | Key restrictions
58
+----------------|---------------|---------------|-------------------------|-----------------
59
+All device-bound passkeys (excluding Microsoft Authenticator) | All users | Device-bound | Enabled | Enabled<br>- Behavior: Block<br>- AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android
60
+Passkeys in Microsoft Authenticator | Pilot group 1<br>Pilot group 2 | Device-bound | Enabled | Enabled<br>- Behavior: Allow<br>- AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android
61
+
62
+### Passkey (FIDO2) Authenticator Attestation GUID (AAGUID)
63
+
64
+The FIDO2 specification requires each passkey vendor to provide an Authenticator Attestation GUID (AAGUID) during registration. An AAGUID is a 128-bit identifier indicating the key type, such as the make and model. Passkey (FIDO2) providers on desktop and mobile devices are also expected to provide an AAGUID during registration.
65
+
66
+>[!NOTE]
67
+>The vendor must ensure that the AAGUID is identical across all substantially identical security keys or passkey (FIDO2) providers made by that vendor, and different (with high probability) from the AAGUIDs of all other types of security keys or passkey (FIDO2) providers. To ensure this, the AAGUID for a given security key model or passkey (FIDO2) provider should be randomly generated. For more information, see [Web Authentication: An API for accessing Public Key Credentials - Level 2 (w3.org)](https://w3c.github.io/webauthn/).
68
+
69
+You can work with your passkey vendor to determine the AAGUID of the passkey (FIDO2), or see [FIDO2 security keys eligible for attestation with Microsoft Entra ID](~/identity/authentication/concept-fido2-hardware-vendor.md#fido2-security-keys-eligible-for-attestation-with-microsoft-entra-id). If the passkey (FIDO2) is already registered, you can find the AAGUID by viewing the authentication method details of the passkey (FIDO2) for the user.
70
+
71
+
72
+
73
+### Passkey profile prerequisites
74
+
5375
- Devices must support passkey (FIDO2) authentication. For Windows devices that are joined to Microsoft Entra ID, the best experience is on Windows 10 version 1903 or higher. Hybrid-joined devices must run Windows 10 version 2004 or higher.
5476
- If a passkey profile for both device-bound and synced passkeys targets Microsoft Authenticator, users need to run Microsoft Authenticator iOS version 6.8.37 or Android version 6.2507.4749.
5577
- Policy size limit:
⋯ 7 unchanged lines
6385
- Users must complete multifactor authentication (MFA) within the past five minutes before they can register a passkey (FIDO2).
6486
- Users need an authenticator that supports Microsoft Entra ID's attestation requirements. For more information, see [Microsoft Entra ID attestation for FIDO2 security key vendors](concept-fido2-hardware-vendor.md).
6587
66
−## Enable passkey profiles
88
+### Enable passkey profiles
6789
6890
> [!NOTE]
6991
> When you enable passkey profiles, your global passkey (FIDO2) policy settings automatically transfer to a **Default passkey profile**. Up to three passkey profiles, including the **Default passkey profile**, are supported. Support for more passkey profiles is in development.
⋯ 18 unchanged lines
88110
89111
1. Select **Save**.
90112
91
−## Create a new passkey profile
113
+### Create a new passkey profile
92114
93115
1. On the **Configure** tab, select **+ Add passkey profile**.
94116
⋯ 18 unchanged lines
113135
114136
1. Select **Save**.
115137
116
−## Apply a passkey profile to a targeted group
138
+### Apply a passkey profile to a targeted group
117139
118140
1. Select **Enable and Target**.
119141
1. Select **Add target**, and then choose **All users** or **Select targets** to choose specific groups.
⋯ 7 unchanged lines
127149
> [!NOTE]
128150
> A target group (for example, Engineering) can be scoped for multiple passkey profiles. When a user is scoped for multiple passkey profiles, registration and authentication with a passkey are allowed if the passkey fully satisfies the requirements of at least one of the scoped passkey profiles. There's no particular order to the check. If a user is a member of an excluded group in the **Passkeys (FIDO2)** authentication method policy, they're blocked from FIDO2 passkey registration or sign-in entirely, and this takes precedence over them being in any **Included** groups.
129151
130
−## Delete a passkey profile
152
+### Delete a passkey profile
131153
132154
1. Select **Configure**.
133155
1. Select the delete icon next to the passkey profile that you want to delete, and then select **Save**.
⋯ 3 unchanged lines
137159
138160
:::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/delete-passkey-profile.png" alt-text="Screenshot that shows how to delete a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/delete-passkey-profile.png":::
139161
140
−## Examples of use cases for passkey profiles
141
−
142
−> [!NOTE]
143
−> If a passkey profile for both device-bound and synced passkeys targets Microsoft Authenticator, users need to run Microsoft Authenticator iOS version 6.8.37 or Android version 6.2507.4749.
144
−
145
−### Special consideration for high-privileged accounts
146
−
147
−Passkey profile | Target groups | Passkey types | Attestation enforcement | Key restrictions
148
−----------------|---------------|---------------|-------------------------|-----------------
149
−All device-bound passkeys (attestation enforced) | IT admins<br>Executives<br>Engineering | Device-bound | Enabled | Disabled
150
−All synced or device-bound passkeys | HR<br>Sales | Device-bound, Synced | Disabled | Disabled
151
−
152
−
153
−### Targeted rollout of passkeys in Microsoft Authenticator
154
−
155
−Passkey profile | Target groups | Passkey types | Attestation enforcement | Key restrictions
156
−----------------|---------------|---------------|-------------------------|-----------------
157
−All device-bound passkeys (excluding Microsoft Authenticator) | All users | Device-bound | Enabled | Enabled<br>- Behavior: Block<br>- AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android
158
−Passkeys in Microsoft Authenticator | Pilot group 1<br>Pilot group 2 | Device-bound | Enabled | Enabled<br>- Behavior: Allow<br>- AAGUIDs: Microsoft Authenticator for iOS, Microsoft Authenticator for Android
162
+## Passkeys (FIDO2)
159163
160
−## What are synced versus device-bound passkeys?
164
+### What are synced versus device-bound passkeys?
161165
162166
Passkeys are FIDO2-based credentials that provide strong, phishing-resistant authentication. Microsoft Entra ID supports two main types of passkeys:
163167
⋯ 8 unchanged lines
172176
> [!NOTE]
173177
> Treat synced passkeys as phishing-resistant credentials but with the same security posture as other unattested authenticators.
174178
175
−## Synced passkey requirements
179
+### Synced passkey requirements
176180
177181
- To enable synced passkeys, your organization must have [passkey profiles](#enable-passkey-profiles) enabled.
178182
- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions.
⋯ 5 unchanged lines
184188
Google Password Manager | Built into Chrome | Built into Chrome | Built into Chrome. iOS 17+ | Natively built in (excluding Samsung devices). Android 9+
185189
Other passkey providers (such as 1Password, Bitwarden) | Check for a browser extension | Check for a browser extension | Check for an app. iOS 17+ | Check for an app. Android 14+
186190
187
−## Enable synced passkeys
191
+### Enable synced passkeys
188192
189193
1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
190194
1. Make sure passkey profiles are enabled.
⋯ 6 unchanged lines
197201
> [!NOTE]
198202
> If you disable synced passkeys for a given passkey profile, targeted users can't sign in with a synced passkey even if they already registered one.
199203
200
−## Delete a passkey (FIDO2)
204
+### Delete a passkey (FIDO2)
201205
202206
To remove a passkey (FIDO2) associated with a user account, delete it from the user's authentication method.
203207
204208
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) and search for the user whose passkey (FIDO2) needs to be removed.
205209
1. Select **Authentication methods** > right-click **Passkey (device-bound)** and select **Delete**.
206210
207
−## Enforce passkey (FIDO2) sign-in
211
+### Enforce passkey (FIDO2) sign-in
208212
209213
To make users sign in with a passkey (FIDO2) when they access a sensitive resource, you can:
210214
⋯ 49 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:02 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.