Passkeys in Microsoft Authenticator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit a8afc9b · +1 −3 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.service: entra-id
66
ms.subservice: authentication
77
ms.topic: how-to
8
−ms.date: 03/04/2025
8
+ms.date: 03/29/2025
99
1010
1111
ms.author: justinha
⋯ 46 unchanged lines
5858
> Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.
5959
6060
- **Key restrictions** set the usability of specific passkeys for both registration and authentication. You can set **Enforce key restrictions** to **No** to allow users to register any supported passkey, including passkey registration directly in the Authenticator app.
61
−
62
− You can set **Enforce key restrictions** to **Yes** to only allow or block certain passkeys, which are identified by their AAGUIDs. Until mid-February, [Security info](https://mysignins.microsoft.com/security-info) requires this setting to be set to **Yes** so that users can choose **Passkey in Authenticator** and go through a dedicated Authenticator passkey registration flow. If you choose **No**, users navigating to SecurityInfo might still be able to add a passkey in Authenticator by choosing the **Security key or passkey** method, depending on their operating system and browser. However, we don't expect many users to discover and use that method.
6361
6462
If you enforce key restrictions and already have active passkey usage, you should collect the AAGUIDs of the passkeys being used today. You can use a PowerShell script to find AAGUIDs that are used in your tenant. For more information, see [Find AAGUIDs](#find-aaguids).
6563
⋯ 137 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.