Passkeys in Microsoft Authenticator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5823dd7 · +148 −56 lines · also on GitHub
11
---
2
−title: Enable passkeys in Authenticator for Microsoft Entra ID
3
−description: Learn about how to enable passkeys in Microsoft Authenticator for Microsoft Entra ID.
2
+title: Enable and support passkeys in Authenticator for Microsoft Entra ID
3
+description: Learn about Authenticator-specific requirements, configuration, and troubleshooting for passkeys in Microsoft Authenticator for Microsoft Entra ID.
44
ms.topic: how-to
5
−ms.date: 06/05/2026
6
−ms.reviewer: mjsantani
7
−ms.custom: sfi-ga-nochange, sfi-image-nochange
8
−# Customer intent: As a Microsoft Entra administrator, I want to learn how to enable and enforce passkeys in Microsoft Authenticator sign-in for users.
5
+ms.date: 07/05/2026
6
+ms.reviewer: mjsantani, calui, tilarso
7
+ms.collection: M365-identity-device-management
8
+ms.custom: sfi-ga-nochange, sfi-image-nochange, msecd-doc-authoring-1013
9
+ai-usage: ai-assisted
10
+# Customer intent: As a Microsoft Entra administrator, I want to learn about Authenticator-specific requirements for passkeys so I can enable and support them for my users.
911
---
1012
# Enable passkeys in Authenticator
1113
12
−This article lists steps to enable and enforce use of passkeys in Authenticator for Microsoft Entra ID. First, you update the Authentication methods policy to allow users to register and sign in with passkeys in Authenticator. Then you can use Conditional Access authentication strengths policies to enforce passkey sign-in when users access a sensitive resource.
14
+This article covers Authenticator-specific requirements and configuration for passkeys in Microsoft Authenticator for Microsoft Entra ID.
1315
14
−## Requirements
16
+Before you follow the steps in this article, enable passkeys and create a passkey profile. For steps, see [Enable passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-passkeys-fido2.md).
1517
16
−- [Microsoft Entra multifactor authentication (MFA)](howto-mfa-getstarted.md).
18
+## Prerequisites for passkeys in Authenticator
19
+
20
+- An account with at least [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) permissions to configure authentication methods.
21
+- You need to [enable passkey sign-in](how-to-authentication-passkeys-fido2.md#enable-passkey-profiles) in the **Passkey (FIDO2)** policy in **Authentication methods** in the Microsoft Entra admin center.
1722
- Android 14 and later or iOS 17 and later.
1823
- For cross-device registration and authentication:
1924
- Make sure that Bluetooth and an active internet connection are enabled on both devices.
⋯ 9 unchanged lines
2934
> [!NOTE]
3035
> Users can't use cross-device registration if you enable attestation.
3136
32
−To learn more about FIDO2 support, see [Support for FIDO2 authentication with Microsoft Entra ID](fido2-compatibility.md).
37
+To learn more about FIDO2 support, see [Support for FIDO2 authentication with Microsoft Entra ID](concept-fido2-compatibility.md).
3338
3439
> [!NOTE]
3540
> If you grant the **Require device to be marked as compliant** control as part of a Conditional Access policy, it doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the **Require device to be marked as compliant** check.
3641
37
−## Enable passkeys in Authenticator in the admin center
42
+## Configure a profile for passkeys in Authenticator
3843
39
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Authentication Policy Administrator](~/identity/role-based-access-control/permissions-reference.md#authentication-policy-administrator).
40
−1. Browse to **Entra ID** > **Authentication methods** > **Authentication method policy**.
41
−1. Under the method **Passkey (FIDO2)**, select **All users** or **Add groups** to select specific groups. *Only security groups are supported*.
42
−1. On the **Configure** tab:
43
− - Set **Allow self-service set up** to **Yes**. If it's set to **No**, users can't register a passkey by using [Security info](https://mysignins.microsoft.com/security-info), even if passkeys (FIDO2) are enabled by the Authentication methods policy.
44
− - Set **Enforce attestation** to **Yes** or **No**. Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.
44
+1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
45
+1. Browse to **Entra ID** > **Authentication methods**.
46
+1. On the **Authentication methods | Policies** page, select **Passkey (FIDO2)** > **Configure**.
47
+1. Select **+ Add profile**.
4548
46
− When attestation is enabled in the passkey (FIDO2) policy, Microsoft Entra ID tries to verify the legitimacy of the passkey being created. When the user is registering a passkey in the Authenticator, attestation verifies that the legitimate Authenticator app created the passkey by using Apple and Google services. Here are more details:
49
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-passkey-profile.png" alt-text="Screenshot that shows how to add a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-passkey-profile.png":::
4750
48
− - **iOS**: Authenticator attestation uses the [iOS App Attest service](https://developer.apple.com/documentation/devicecheck/preparing-to-use-the-app-attest-service) to ensure the legitimacy of the Authenticator app before registering the passkey.
49
−␣␣␣␣␣␣␣␣␣␣␣␣
50
− - **Android**:
51
− - For Play Integrity attestation, Authenticator attestation uses the [Play Integrity API](https://developer.android.com/google/play/integrity/overview) to ensure the legitimacy of the Authenticator app before registering the passkey.
52
− - For Key attestation, Authenticator attestation uses [key attestation by Android](https://developer.android.com/privacy-and-security/security-key-attestation) to verify that the passkey being registered is hardware-backed.
51
+1. Enter a **Name** for the profile, such as **Authenticator passkeys**.
52
+1. Choose whether to **Enforce attestation**. For more information, see [Authenticator attestation](#authenticator-attestation).
53
+1. For **Passkey types**, select **Device-bound**.
54
+1. Select **Target specific AAGUIDS** and set **Behavior** to **Allow**.
55
+1. Select **+ Add AAGUID** > **Microsoft Authenticator** and **Save**.
5356
54
− > [!NOTE]
55
− > For both iOS and Android, Authenticator attestation relies upon Apple and Google services to verify the authenticity of the Authenticator app. Heavy service usage can make passkey registration fail, and users might need to try again. If Apple and Google services are down, Authenticator attestation blocks registration that requires attestation until services are restored. To monitor the status of Google Play Integrity service, see [Google Play Status Dashboard](https://status.play.google.com/). To monitor the status of the iOS App Attest service, see [System Status](https://developer.apple.com/system-status/).
56
−
57
+ :::image type="content" border="true" source="media/how-to-enable-authenticator-passkey/authenticator-passkey-profile.png" alt-text="Screenshot that shows the Add passkey profile settings for Authenticator passkeys." lightbox="media/how-to-enable-authenticator-passkey/authenticator-passkey-profile.png":::
5758
59
+## Enable and target groups for a profile for passkeys in Authenticator
5860
59
− - **Key restrictions** set the usability of specific passkeys for both registration and authentication. You can set **Enforce key restrictions** to **No** to allow users to register any supported passkey, including passkey registration directly in the Authenticator app. If you set **Enforce key restrictions** to **Yes** and already have active passkey usage, you should collect and add the AAGUIDs of the passkeys being used today.
61
+1. Sign in to the Microsoft Entra admin center as at least an [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator).
62
+1. Browse to **Entra ID** > **Authentication methods**.
63
+1. On the **Authentication methods | Policies** page, select **Passkey (FIDO2)** > **Enable and target**.
64
+1. On the **Enable and Target** tab, make sure **Enable** is **On**.
65
+1. Select **Add target**, and choose **All users** or **Select targets** to choose specific groups.
6066
67
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-target.png" alt-text="Screenshot that shows how to add a target for a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-target.png":::
6168
62
− If you set **Restrict specific keys** to **Allow**, select **Microsoft Authenticator** to automatically add the Authenticator app AAGUIDs to the key restrictions list. You can also manually add the following AAGUIDs to allow users to register passkeys in Authenticator by signing in to the Authenticator app or by going through a guided flow on **Security info**:
69
+1. Select the profile for passkeys in Authenticator and **Save**.
6370
64
− - **Authenticator for Android**: `de1e552d-db1d-4423-a619-566b625cdc84`
65
− - **Authenticator for iOS**: `90a3ccdf-635c-4729-a248-9b709135078f`
66
−
67
− If you change key restrictions and remove an AAGUID that you previously allowed, users who previously registered an allowed method can no longer use it for sign-in.
71
+ :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/enable-target-authenticator.png" alt-text="Screenshot that shows how to enable and target a profile for passkeys in Authenticator." lightbox="media/how-to-authentication-passkey-profiles/enable-target-authenticator.png":::
6872
69
− > [!NOTE]
70
− > If you turn off key restrictions, make sure you clear the **Microsoft Authenticator** checkbox so that users aren't prompted to set up a passkey in the Authenticator app on [Security info](https://mysignins.microsoft.com/security-info).
73
+ > [!NOTE]
74
+ > A target group (for example, Engineering) can be scoped for multiple passkey profiles. When a user is scoped for multiple passkey profiles, registration and authentication with a passkey are allowed if the passkey fully satisfies the requirements of at least one of the scoped passkey profiles. There's no particular order to the check. If a user is a member of an excluded group in the **Passkey (FIDO2)** policy, they're blocked from passkey (FIDO2) registration or sign-in entirely. The block takes precedence over membership in any included groups.
7175
72
− :::image type="content" border="true" source="media/how-to-enable-authenticator-passkey/optional-settings.png" alt-text="Screenshot that shows Authenticator enabled for passkey."lightbox="media/how-to-enable-authenticator-passkey/optional-settings.png":::
76
+## Authenticator attestation
7377
74
−1. After you finish the configuration, select **Save**.
78
+When you enable passkeys and create a passkey profile in the Microsoft Entra admin center, you can choose whether to enforce attestation. For general steps to configure passkey profiles, see [Enable passkeys (FIDO2)](how-to-authentication-passkeys-fido2.md).
7579
76
− If you see an error when you try to save, replace multiple groups with a single group in one operation, and then select **Save** again.
80
+When attestation is enabled, Microsoft Entra ID verifies the legitimacy of the passkey being created. When the user is registering a passkey in the Authenticator, attestation verifies that the legitimate Authenticator app created the passkey by using Apple and Google services:
7781
82
+- **iOS**: Authenticator attestation uses the [iOS App Attest service](https://developer.apple.com/documentation/devicecheck/preparing-to-use-the-app-attest-service) to ensure the legitimacy of the Authenticator app before registering the passkey.
83
+
84
+- **Android**:
85
+ - For Play Integrity attestation, Authenticator attestation uses the [Play Integrity API](https://developer.android.com/google/play/integrity/overview) to ensure the legitimacy of the Authenticator app before registering the passkey.
86
+ - For Key attestation, Authenticator attestation uses [key attestation by Android](https://developer.android.com/privacy-and-security/security-key-attestation) to verify that the passkey being registered is hardware-backed.
87
+
88
+> [!NOTE]
89
+> For both iOS and Android, Authenticator attestation relies upon Apple and Google services to verify the authenticity of the Authenticator app. Heavy service usage can make passkey registration fail, and users might need to try again. If Apple and Google services are down, Authenticator attestation blocks registration that requires attestation until services are restored. To monitor the status of Google Play Integrity service, see [Google Play Status Dashboard](https://status.play.google.com/). To monitor the status of the iOS App Attest service, see [System Status](https://developer.apple.com/system-status/).
90
+
91
+Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.
92
+
93
+## Authenticator AAGUIDs
94
+
95
+You can restrict users to use Authenticator passkeys by targeting the Authenticator Attestation Globally Unique Identifier (AAGUID) in the passkey profile.
96
+
97
+If you prefer, you can also select **+ Add AAGUID** and manually add the following AAGUIDs:
98
+
99
+- **Authenticator for Android**: `de1e552d-db1d-4423-a619-566b625cdc84`
100
+- **Authenticator for iOS**: `90a3ccdf-635c-4729-a248-9b709135078f`
101
+
102
+If you remove an AAGUID that you previously allowed, users who previously registered an allowed method can no longer use it for sign-in.
103
+
78104
## Enable passkeys in Authenticator by using Graph Explorer
79105
80
−In addition to using the Microsoft Entra admin center, you can also enable passkeys in Authenticator by using Graph Explorer. If you're assigned at least the [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) role, you can update the Authentication methods policy to allow the AAGUIDs for Authenticator.
106
+In addition to using the Microsoft Entra admin center, you can enable passkeys in Authenticator by using Graph Explorer. If you're assigned at least the [Authentication Policy Administrator](../role-based-access-control/permissions-reference.md#authentication-policy-administrator) role, you can update the Authentication methods policy to allow the AAGUIDs for Authenticator.
81107
108
+> [!NOTE]
109
+> The following example uses the tenant-level FIDO2 configuration endpoint. For the profile-based approach to passkey management, see [Enable passkeys (FIDO2)](how-to-authentication-passkeys-fido2.md).
110
+
82111
To configure the policy by using Graph Explorer:
83112
84113
1. Sign in to [Graph Explorer](https://aka.ms/ge) and consent to the **Policy.Read.All** and **Policy.ReadWrite.AuthenticationMethod** permissions.
⋯ 4 unchanged lines
89118
GET https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2
90119
```
91120
92
−1. To disable attestation enforcement and enforce key restrictions to allow only AAGUIDs for Authenticator, perform a `PATCH` operation by using the following request body:
121
+1. To enable attestation enforcement and enforce key restrictions to allow only AAGUIDs for Authenticator, perform a `PATCH` operation by using the following request body:
93122
94123
```json
95124
PATCH https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2
⋯ 26 unchanged lines
122151
123152
Some organizations restrict Bluetooth usage, which includes the use of passkeys. In such cases, organizations can allow passkeys by permitting Bluetooth pairing exclusively with passkey-enabled FIDO2 authenticators. For more information about how to configure Bluetooth usage only for passkeys, see [Passkeys in Bluetooth-restricted environments](/windows/security/identity-protection/passkeys/?tabs=windows%2Cintune#passkeys-in-bluetooth-restricted-environments).
124153
125
−## Delete a passkey
154
+## Troubleshoot passkeys in Authenticator
126155
127
−If a user deletes a passkey in Authenticator, the passkey is also removed from the user's sign-in methods. An Authentication Policy Administrator can also follow these steps to delete a passkey from the user's authentication methods, but it won't remove the passkey from Authenticator.
156
+This section covers issues that users might see when they use passkeys in Authenticator and possible ways for administrators to resolve them.
128157
129
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com), and search for the user whose passkey must be removed.
130
−1. Select **Authentication methods**, right-click **Passkey**, and select **Delete**.
158
+### Store passkeys in Android profiles
131159
132
− Unless the user initiated the passkey deletion themselves in Authenticator, they need to also remove the passkey in Authenticator on their device.
160
+Passkeys on Android are used only from the profile where they're stored. If a passkey is stored in an Android Work profile, it's used from that profile. If a passkey is stored in an Android Personal profile, it's used from that profile. To make sure that users can access and use the passkey they need, users with both an Android Personal profile and an Android Work profile should create their passkeys in Authenticator for each profile.
133161
134
−## Enforce sign-in with passkeys in Authenticator
162
+### Workarounds for an authentication strength Conditional Access policy loop
135163
136
−To make users sign in with a passkey when they access a sensitive resource, use the built-in phishing-resistant authentication strength, or create a custom authentication strength by following these steps:
164
+Users can get in a loop when they try to add a passkey in Authenticator if a Conditional Access policy requires phishing-resistant authentication to access **All resources (formerly 'All cloud apps')**. For example:
137165
138
−1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a Conditional Access Administrator.
139
−1. Browse to **Entra ID** > **Authentication methods** > **Authentication strengths**.
140
−1. Select **New authentication strength**.
141
−1. Provide a descriptive name for your new authentication strength.
142
−1. Optionally, provide a description.
143
−1. Select **Passkeys (FIDO2)**, and then select **Advanced options**.
144
−1. Select **Phishing-resistant MFA strength** or add AAGUIDs for passkeys in Authenticator:
166
+- Condition: **All devices (Windows, Linux, macOS, Windows, Android)**
167
+- Targeted resource: **All resources (formerly 'All cloud apps')**
168
+- Grant control: **Authentication strength – Require passkey in Authenticator**
145169
146
− - **Authenticator for Android**: `de1e552d-db1d-4423-a619-566b625cdc84`
147
− - **Authenticator for iOS**: `90a3ccdf-635c-4729-a248-9b709135078f`
170
+The policy forces targeted users to use a passkey to sign in to all cloud applications, which includes the Authenticator app. It requires users to use a passkey when they try to add a passkey in Authenticator on either Android or iOS.
148171
149
−1. Select **Next**, and review the policy configuration.
172
+Here are some workarounds:
150173
174
+- You can [filter for applications](~/identity/conditional-access/concept-filter-for-applications.md) and transition the policy target from **All resources (formerly 'All cloud apps')** to specific applications. Start with a review of applications that are used in your tenant. Use filters to tag Authenticator and other applications.
175
+- To further reduce support costs, you can run an internal campaign to help users adopt passkeys before you enforce them. When you're ready to enforce passkey usage, create two Conditional Access policies:
176
+
177
+ - A policy for mobile operating system (OS) versions
178
+ - A policy for desktop OS versions
179
+
180
+ Require a different authentication strength for each policy, and configure other policy settings listed in the following table. You can enable a [Temporary Access Pass (TAP)](howto-authentication-temporary-access-pass.md) for users or enable other authentication methods to help users register the passkey.
181
+
182
+ A TAP limits the time when users can register a passkey. You can accept it only on mobile platforms where you allow passkey registration.
183
+
184
+ | Conditional Access policy | Desktop OS | Mobile OS |
185
+ |---------------------------|----------------|---------------|
186
+ | Name | Require a passkey in Authenticator to access a desktop OS. | Require a TAP, a phishing-resistant credential, or any other specified authentication method to access a mobile OS. |
187
+ | Condition | Specific devices (desktop operating systems). | Specific devices (mobile operating systems). |
188
+ | Devices | N/A. | Android, iOS. |
189
+ | Exclude devices | Android, iOS. | N/A. |
190
+ | Targeted resource | All resources. | All resources. |
191
+ | Grant control | Authentication strength. | Authentication strength.<sup>1</sup> |
192
+ | Methods | Passkey in Authenticator. |TAP, passkey in Authenticator. |
193
+ | Policy result | Users who can't sign in with a passkey in Authenticator are directed to the **My Sign-ins** wizard mode. After registration, they're asked to sign in to Authenticator on their mobile device. | Users who sign in to Authenticator with a TAP or another allowed method can register a passkey directly in Authenticator. No loop occurs because the user meets the authentication requirements. |
194
+
195
+ <sup>1</sup>For users to register new sign-in methods, your grant control for the mobile policy needs to match your Conditional Access policy to register [Security info](https://mysignins.microsoft.com/security-info).
196
+
197
+> [!NOTE]
198
+> With either workaround, users must also satisfy any Conditional Access policy that targets **Register security info** or they can't register the passkey. If you have other conditions set up with the **All resources** policies, those conditions must be met when the passkey is registered.
199
+
200
+### Users who can't register passkeys because of Require approved client app or Require app protection policy Conditional Access grant controls
201
+
202
+Users can't register passkeys in Authenticator if they're included in the following Conditional Access policy:
203
+
204
+- Condition: **All devices (Windows, Linux, macOS, Windows, Android)**
205
+- Targeted resource: **All resources (formerly 'All cloud apps')**
206
+- Grant control: **Require approved client app** or **Require app protection policy**
207
+
208
+The policy forces users to sign in to all cloud applications by using an app that supports [Microsoft Intune app protection policies](/mem/intune/apps/app-protection-policy). Authenticator doesn't support this policy on either Android or iOS.
209
+
210
+Here are some workarounds:
211
+
212
+- You can [filter for applications](~/identity/conditional-access/concept-filter-for-applications.md) and transition the policy target from **All resources (formerly 'All cloud apps')** to specific applications. Start with a review of applications that are used in your tenant. Use filters to tag appropriate applications.
213
+- You can use mobile device management (MDM) and the **Require device to be marked as compliant** control. Authenticator can satisfy this grant control if MDM fully manages the device and it's compliant. For example:
214
+
215
+ - Condition: **All devices (Windows, Linux, macOS, Windows, Android)**
216
+ - Targeted resource: **All resources (formerly 'All cloud apps')**
217
+ - Grant control: **Require approved client app**, or **Require app protection policy**, or **Require device to be marked as compliant**
218
+
219
+- You can grant users a temporary exemption from the Conditional Access policy. Consider using one or more compensating controls:
220
+ - Allow the exemption for only a limited period of time. Communicate to the user when they're allowed to register a passkey. Remove the exemption after the time period. Then direct users to call the help desk if they missed their time.
221
+ - Use another Conditional Access policy to require that users register only from a specific network location or a compliant device.
222
+
223
+> [!NOTE]
224
+> With any proposed workaround, users must also satisfy any Conditional Access policy that targets **Register security info** or they can't register the passkey. If you have other conditions set up with the **All resources** policies, they also must be met before users can register a passkey.
225
+
226
+## Register a passkey in Authenticator
227
+
228
+After an admin enables passkeys in Authenticator, users can register a passkey in the app on their iOS or Android device.
229
+
230
+For registration steps, see [Register a passkey in Microsoft Authenticator](how-to-register-passkey-authenticator.md).
231
+
232
+## Sign in with a passkey in Authenticator
233
+
234
+After registration, users can sign in to Microsoft Entra ID by using the passkey in Authenticator on their device.
235
+
236
+For sign-in steps, see [Sign in with passkeys in Authenticator](how-to-sign-in-passkey-authenticator.md).
237
+
151238
## Related content
152239
240
+- [Enable passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-passkeys-fido2.md)
241
+- [Register a passkey in Microsoft Authenticator](how-to-register-passkey-authenticator.md)
242
+- [Sign in with passkeys in Authenticator](how-to-sign-in-passkey-authenticator.md)
243
+- [Microsoft Authenticator authentication method](concept-authentication-authenticator-app.md)
244
+- [Support for FIDO2 authentication with Microsoft Entra ID](concept-fido2-compatibility.md)
153245
- [Support for passkey in Windows](/windows/security/identity-protection/passkeys)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:15 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.