Passkeys in Microsoft Authenticator

This page's changes and edits · All guidance changes

Microsoft's edit · 31 Mar 2025 18:33 UTC

moved note

Microsoft's commit message in MicrosoftDocs/entra-docs · commit b1246a1 · +3 ~~−50~~ lines · also on GitHub

⋯ 4 unchanged lines

55 ms.service: entra-id

66 ms.subservice: authentication

77 ms.topic: how-to

8 −ms.date: 03/29/2025

8 +ms.date: 03/31/2025

1010

1111 ms.author: justinha

⋯ 29 unchanged lines

4141 1. Under the method **Passkey (FIDO2)**, select **All users** or **Add groups** to select specific groups. *Only security groups are supported*.

4242 1. On the **Configure** tab:

4343 - Set **Allow self-service set up** to **Yes**. If it's set to **No**, users can't register a passkey by using [Security info](https://mysignins.microsoft.com/security-info), even if passkeys (FIDO2) are enabled by the Authentication methods policy.

44 − - Set **Enforce attestation** to **Yes** or **No**.

44 + - Set **Enforce attestation** to **Yes** or **No**. Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.

4545

4646 When attestation is enabled in the passkey (FIDO2) policy, Microsoft Entra ID tries to verify the legitimacy of the passkey being created. When the user is registering a passkey in the Authenticator, attestation verifies that the legitimate Authenticator app created the passkey by using Apple and Google services. Here are more details:

4747

⋯ 6 unchanged lines

5454 > [!NOTE]

5555 > For both iOS and Android, Authenticator attestation relies upon Apple and Google services to verify the authenticity of the Authenticator app. Heavy service usage can make passkey registration fail, and users might need to try again. If Apple and Google services are down, Authenticator attestation blocks registration that requires attestation until services are restored. To monitor the status of Google Play Integrity service, see [Google Play Status Dashboard](https://status.play.google.com/). To monitor the status of the iOS App Attest service, see [System Status](https://developer.apple.com/system-status/).

5656

57 − > [!NOTE]

58 − > Users can only register attested passkeys directly in the Authenticator app. Cross-device registration flows don't support registration of attested passkeys.

5957

6058 - **Key restrictions** set the usability of specific passkeys for both registration and authentication. You can set **Enforce key restrictions** to **No** to allow users to register any supported passkey, including passkey registration directly in the Authenticator app.

6159

62 − If you enforce key restrictions and already have active passkey usage, you should collect the AAGUIDs of the passkeys being used today. You can use a PowerShell script to find AAGUIDs that are used in your tenant. For more information, see [Find AAGUIDs](#find-aaguids).

60 + If you enforce key restrictions and already have active passkey usage, you should collect the AAGUIDs of the passkeys being used today.

6361

6462 If you set **Restrict specific keys** to **Allow**, select **Microsoft Authenticator** to automatically add the Authenticator app AAGUIDs to the key restrictions list. You can also manually add the following AAGUIDs to allow users to register passkeys in Authenticator by signing in to the Authenticator app or by going through a guided flow on **Security info**:

6563

⋯ 53 unchanged lines

119117 GET https://graph.microsoft.com/v1.0/authenticationMethodsPolicy/authenticationMethodConfigurations/FIDO2

120118 ```

121119

122 −## Find AAGUIDs

123 −

124 −Use the `GetRegisteredPasskeyAAGUIDsForAllUsers.ps1` Microsoft Graph PowerShell script to enumerate the AAGUIDs of all registered passkeys in the tenant.

125 −

126 −Save the body of this script to a file called `GetRegisteredPasskeyAAGUIDsForAllUsers.ps1`.

127 −

128 −```powershell

129 −# Disconnect from Microsoft Graph

130 −Disconnect-MgGraph

131 −

132 −# Connect to Microsoft Graph with required scopes

133 −Connect-MgGraph -Scope 'User.Read,UserAuthenticationMethod.Read,UserAuthenticationMethod.Read.All'

134 −

135 −# Define the output file [If the script is run more than once, delete the file to avoid appending to it.]

136 −$file = ".\AAGUIDs.txt"

137 −

138 −# Initialize the file with a header

139 −Set-Content -Path $file -Value '---'

140 −

141 −# Retrieve all users

142 −$UserArray = Get-MgBetaUser -All

143 −

144 −# Iterate through each user

145 −foreach ($user in $UserArray) {

146 − # Retrieve Passkey authentication methods for the user

147 − $fidos = Get-MgBetaUserAuthenticationFido2Method -UserId $user.Id

148 −

149 − if ($fidos -eq $null) {

150 − # Log and write to file if no Passkey methods are found

151 − Write-Host "User object ID $($user.Id) has no Passkey"

152 − Add-Content -Path $file -Value "User object ID $($user.Id) has no Passkey"

153 − } else {

154 − # Iterate through each Passkey method

155 − foreach ($fido in $fidos) {

156 − # Log and write to file the Passkey details

157 − Write-Host "- User object ID $($user.Id) has a Passkey with AAGUID $($fido.Aaguid) of Model type '$($fido.Model)'"

158 − Add-Content -Path $file -Value "- User object ID $($user.Id) has a Passkey with AAGUID $($fido.Aaguid) of Model type '$($fido.Model)'"

159 − }

160 − }

161 −

162 − # Log and write a separator to file

163 − Write-Host "==="

164 − Add-Content -Path $file -Value "==="

165 −}

166 −```

167120

168121 ## Restrict Bluetooth usage to passkeys in Authenticator

169122

⋯ 31 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.