Microsoft Entra Passkeys on Windows

© 2023 CDW LLC. Designed by CDW Amplified for Education
  1. CDW Amplified for Education Help Center
  2. Microsoft
  3. Identity & Access Management

Microsoft Entra Passkeys on Windows

Microsoft Entra passkeys on Windows lets users register device-bound FIDO2 passkeys directly in the local Windows Hello container and use Windows Hello PIN, fingerprint, or face verification to sign in to Microsoft Entra ID. Microsoft’s release notes identify the Windows passkey feature as Public Preview, while passkey profiles in Microsoft Entra ID are Generally Available.

In educational environments, the most common scenarios are Bring Your Own Devices (BYOD), library computers, shared classroom or lab PCs, and users with multiple school/work accounts on the same Windows device. This does not replace Windows Hello for Business and cannot be used for Windows device sign-in.

In this article, you will learn:

Affected Systems
Prerequisites and Licensing
Symptoms / Observable Behavior
Root Cause / What Changed
Resolution / Recommended Action
Step-by-Step Deployment or Validation Steps
Workarounds / Known Limitations
Administrator Notes for Education
Validation and Corrections Applied to Uploaded Draft
References
 

Affected Systems

  • Windows 10 and Windows 11 devices that support Windows Hello.
  • Unmanaged, personal, shared, lab, library, or other devices that are not Microsoft Entra joined or registered.
  • Microsoft Entra ID authentication flows that allow passkeys (FIDO2) by policy.
  • Users in groups targeted by a passkey (FIDO2) authentication methods policy/profile.

Prerequisites and Licensing

  • Passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free. Microsoft states no extra licenses are required for passkeys (FIDO2).
  • An Authentication Policy Administrator is needed to configure passkey profiles.
  • The Windows device must run Windows 10 or Windows 11 and must support Windows Hello.
  • The passkey profile used for Microsoft Entra passkeys on Windows must include Device-bound as a passkey type and must not enforce attestation because Microsoft states attestation is not supported for Microsoft Entra passkey on Windows.
  • Users must complete MFA shortly before registration or use a Temporary Access Pass issued by an Authentication Policy Administrator.

Symptoms / Observable Behavior

  • Users register from Security info by selecting Add sign-in method > Passkey > Add, then complete MFA or use Temporary Access Pass.
  • During registration, Windows shows a security dialog asking where to save the passkey. On a supported Windows device, the user can save it locally in Windows Hello.
  • During sign-in, the user uses Windows Hello PIN, fingerprint, or facial recognition to satisfy the passkey prompt.
  • If Windows Hello for Business already exists for the same account and local container, Microsoft states that passkey registration can fail because the credential already exists.
  • Microsoft Entra passkey on Windows is device-bound and not synced. Each device needs its own registration.

Root Cause / What Changed

Microsoft is extending Microsoft Entra passkey registration to the Windows Hello local container, so a device does not need to be Microsoft Entra-joined or registered to store and use a local Entra passkey. This differs from Windows Hello for Business, which is primarily a managed-device credential and can enable device sign-in and SSO. Microsoft Entra passkeys on Windows are standard FIDO2 credentials for Entra authentication and cannot be used for Windows device sign-in.

Resolution / Recommended Action

  • Treat Microsoft Entra passkeys on Windows as a Public Preview feature. Use a pilot first; do not publish as fully GA unless Microsoft updates the official release status.
  • Use passkey profiles to target a pilot group rather than enabling the experience for all users at once.
  • Review Conditional Access policies before rollout. Avoid blocking registration by requiring phishing-resistant authentication before the user has a passkey or another allowed phishing-resistant method.
  • Plan Temporary Access Passes for users who need a strong bootstrap method to register their first passkey.
  • Use attested security keys or other supported attested authenticators for admin or compliance scenarios that require attestation; Microsoft Entra passkeys on Windows do not support attestation.
  • Treat Microsoft Entra passkeys on Windows as a Public Preview feature. Use a pilot first; do not publish as fully GA unless Microsoft updates the official release status.
  • Use passkey profiles to target a pilot group rather than enabling the experience for all users at once.
  • Review Conditional Access policies before rollout. Avoid blocking registration by requiring phishing-resistant authentication before the user has a passkey or another allowed phishing-resistant method.
  • Plan Temporary Access Passes for users who need a strong bootstrap method to register their first passkey.
  • Use attested security keys or other supported attested authenticators for admin or compliance scenarios that require attestation; Microsoft Entra passkeys on Windows do not support attestation.

Step-by-Step Deployment or Validation Steps

  1. In the Microsoft Entra admin center, go to Entra ID > Security > Authentication methods > Policies > Passkey (FIDO2).
  2. If not already enabled, opt in to passkey profiles. Microsoft states that after opt-in, the global passkey settings transfer to the Default passkey profile, and you cannot opt out of profiles.
  3. Create a pilot group, such as EDU-Pilot-Passkey-Windows, and include a small set of IT admins, faculty/staff, and shared-device test users.
  4. Create or edit a passkey profile for Windows. 
    • Set Enforce attestation to off/No.
    • Ensure Passkey types include Device-bound.
  5. Target the passkey profile to the pilot group. Excluded groups take precedence over included groups in the Passkey (FIDO2) authentication method policy.
  6. Confirm Conditional Access policies allow the registration flow. If strong authentication is required for registration, issue Temporary Access Pass or ensure the user has another valid MFA method.
  7. Have a pilot user go to Security info, select Add sign-in method > Passkey > Add, complete MFA or Temporary Access Pass, and save the passkey on the Windows device.
  8. Validate sign-in to Microsoft 365, Entra-integrated apps, and any applications where Conditional Access requires phishing-resistant authentication.
  9. Review sign-in logs and authentication method details to confirm the passkey is used successfully. Track failures related to unsupported devices, Windows Hello conflicts, Conditional Access blocks, or policy targeting.
  10. Only after pilot validation, phase rollout by user population: IT admins, staff, student BYOD users, shared lab/library devices, then broader student groups if appropriate.

Official Platform Image

Add passkey profile configured for passkey on Windows with attestation not enforced and Device-bound selected

Official Microsoft Learn image: Add passkey profile configured for passkey on Windows with attestation not enforced and Device-bound selected.

Workarounds / Known Limitations

  • Windows Hello for Business conflict: if the same account already has a Windows Hello for Business credential in the same container, passkey registration can fail. Use Windows Hello for Business for managed-device sign-in or test with a different device/account path.
  • Attestation requirement: Microsoft states attestation is not supported for Microsoft Entra passkey on Windows. Use attested security keys or supported attested authenticators where compliance requires attestation.
  • No sync: Microsoft Entra passkey on Windows is local and device-bound. Users must register separately on each Windows device.
  • Guest users: Microsoft’s passkey (FIDO2) documentation states that registration is not supported for internal or external guest users, including B2B collaboration users in the resource tenant.
  • UPN changes: if a user’s UPN changes, Microsoft states the user needs to delete the old passkey and add a new one.

Administrator Notes for Education

  • Shared-device privacy: document that a passkey is stored in the local Windows Hello container. Validate Shared PC mode, account cleanup, and user profile deletion policies before deploying on library or classroom PCs.
  • Student support: passkeys reduce phishing risk, but enrollment and recovery flows can increase helpdesk demand. Build a Temporary Access Pass request/identity proofing process before rollout.
  • BYOD governance: because devices do not need to be Entra-joined or registered, passkeys on Windows can help with unmanaged student or adjunct devices without expanding device enrollment. This does not provide device compliance or management on its own.
  • Admin accounts: for high-privilege admin accounts, prefer attested security keys or Microsoft Authenticator/device-bound passkeys where your policy requires attestation or stricter inventory control.

Validation and Corrections Applied to Uploaded Draft

  • Corrected release status from General Availability to Public Preview for Microsoft Entra passkeys on Windows. Passkey profiles are GA, but Windows passkey support remains listed as Public Preview in Entra release notes.
  • Removed the draft’s auto-enablement and AAGUID block-list guidance. Current Microsoft Learn setup guidance requires a device-bound passkey type and no attestation; it does not require the draft’s block-list workflow.
  • Corrected the feature scope: Microsoft Entra passkey on Windows does not require Microsoft Entra join/registration, does not replace Windows Hello for Business, and cannot be used for device sign-in.
  • Corrected licensing: passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Free, with no extra license requirement.
  • Validation confidence: 91%
  • Human review recommended for Tenant-specific Message Center announcement details, Conditional Access policy interactions, and shared-device operational policy.

References

Comments

0 comments

Please sign in to leave a comment.

Articles in this section