Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Configure passkeys in the Microsoft Entra admin center under Entra ID > Security > Authentication methods > Policies. Enable a Passkey (FIDO2) profile, choose device-bound credentials, synced credentials, or both, target the profile to users or groups, and then use Conditional Access authentication strengths when a particular resource must require a passkey. Keep administrators from being locked out by requiring multiple strong methods, protecting Security info registration, and setting SSPR requirements deliberately.
Passkeys are available in every Microsoft Entra ID edition, including the Free edition, with no additional license required. The security and recovery result depends on how you select authenticator types, attestation, AAGUID restrictions, group scope, and backup methods—not merely on switching the policy on.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat must be in place before enabling passkeys?
Start with an account that has at least the Authentication Policy Administrator role. Use a separate, trusted administration account rather than making day-to-day changes with a highly privileged identity that has no recovery path. Decide which users need passkeys first, which authenticator types they may register, and how they will regain access if a device or key is lost.
- Administrative role: Authentication Policy Administrator is the minimum role for configuring Passkey (FIDO2) profiles, including synced-passkey profiles.
- Scope: Prepare security groups for a pilot, workforce users, administrators, and any other populations with different assurance requirements.
- Recovery: Ensure the administrators making the change have at least two strong registered methods before editing policy.
- Registration path: Plan to allow self-service setup so users can register from Security info.
- Access controls: Decide which Conditional Access policies will protect registration and which applications will require a phishing-resistant method.
Passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free. No extra licenses are required.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I enable a Passkey (FIDO2) profile?
Enable the profile in the Authentication methods policy, then configure its scope and requirements before users begin registering credentials.
- Sign in to the Microsoft Entra admin center with an account holding at least Authentication Policy Administrator.
- Open Entra ID > Security > Authentication methods > Policies.
- Select Passkey (FIDO2). Opt in to passkey profiles if the tenant has not already moved to the profile-based experience.
- Review the settings Microsoft carries into the Default passkey profile. Existing global settings are transferred there when profiles are enabled.
- Set Allow self-service setup to Yes. This exposes passkey registration through each user’s Security info page.
- Open Enable and target, switch Enable on, and choose All users or Selected groups.
- Select the profile that should apply to the chosen scope and save the policy.
Use a selected group for an initial deployment so registration, sign-in, and recovery can be verified with real accounts before expanding the assignment. Keep an emergency administration path available while the first group is testing.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should a profile allow device-bound passkeys, synced passkeys, or both?
The choice is a trade-off between portability and control. Device-bound credentials remain tied to a security key, Microsoft Authenticator, or supported device. Synced credentials are made available through a platform or password-manager provider, which is more convenient when people use several devices.
| Choice | How it works | Strengths | Trade-offs and suitable use |
|---|---|---|---|
| Device-bound | The credential stays on a security key, Microsoft Authenticator, or supported device. | Stronger control over where the credential exists; suitable for high-assurance roles. | Replacement or recovery is needed if the device or key is unavailable. Use for administrators and other privileged users when assurance is the priority. |
| Synced | A supported provider makes the passkey available on the user’s other devices. | Convenient portability and easier use across a workforce with multiple devices. | Availability and protection depend on the platform or provider. Use when broad workforce convenience matters. |
| Both | The profile accepts either type when the credential meets the profile’s other requirements. | Lets users choose a convenient method while preserving an option for a device-bound credential. | Review the resulting assurance carefully; a synced credential may satisfy the same profile unless you separate populations or use Conditional Access authentication strengths. |
Microsoft advises considering device-bound FIDO2 security keys or Microsoft Authenticator for administrators and highly privileged users. A practical design is to offer synced passkeys to the broad workforce while assigning a device-bound profile to privileged groups.
What do attestation and AAGUID restrictions control?
Enforce attestation asks Microsoft Entra to verify an authenticator’s make and model when the credential is registered. Use it when the organization must know that registrations come from an approved authenticator class.
An AAGUID restriction allowlist or blocklist narrows registration to particular authenticator models or providers. Attestation is evaluated at registration time. Changing the attestation setting later does not retroactively block a credential that was already registered, so review existing registrations separately when tightening a policy.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do I target a passkey profile to the right users?
Profiles are assigned from the Enable and target page. Choose All users for a tenant-wide policy or Selected groups for a controlled rollout, then select the profile and save.
- Excluded users are blocked even when they are members of an included group.
- If a user matches more than one profile, registration and sign-in are allowed when the passkey satisfies at least one applicable profile.
- Use separate groups when administrators need stricter authenticator controls than ordinary users.
- Document group ownership and exclusions so a later membership change does not silently alter who can register.
For a pilot, assign a small test group and verify both registration and a real sign-in to the applications the group uses. Expand the assignment only after the group has a second working method and the help desk knows the recovery procedure.
How do I configure synced passkeys?
Create or edit a profile, select Synced under Passkey type, and target it to the users or groups who may use provider-synced credentials.
- Open Entra ID > Security > Authentication methods > Policies > Passkey (FIDO2).
- Create a new profile or edit an existing one.
- Under Passkey type, select Synced. Set any attestation or AAGUID controls that apply to the providers you intend to accept.
- Use Enable and target to assign the profile to all users or selected groups.
- Confirm that Allow self-service setup is enabled, then have a test user register from Security info.
Microsoft documents these platform requirements for supported providers:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Provider or platform | Documented requirement |
|---|---|
| Apple Passwords | macOS 13 or later and iOS 16 or later |
| Google Password Manager | Android 9 or later and Chrome |
| Supported third-party providers | Providers such as 1Password or Bitwarden, on the platform versions they support |
Because a synced credential follows the provider’s supported-device and account model, confirm that the provider is available on every platform the assigned users need. A device-bound profile remains the better fit for an administrator whose access must not depend on a consumer sync ecosystem.
How do I configure Microsoft Authenticator passkeys?
Microsoft Authenticator passkeys use a device-bound profile. Microsoft lists Android 14 or later and iOS 17 or later as prerequisites.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Create or edit a Passkey (FIDO2) profile and select Device-bound.
- Optionally turn on Enforce attestation and restrict registrations by AAGUID.
- Add Microsoft Authenticator to the allowed authenticator list.
- Target the profile to all users or to selected groups, then save.
- Have a test user register Authenticator from Security info and complete a sign-in to a protected application.
Cross-device registration or authentication requires Bluetooth, internet connectivity, and access to the endpoints Microsoft permits. If a cross-device prompt fails, check those prerequisites before changing the Entra policy.
How do I configure Windows Hello passkeys?
Windows Hello passkeys require a device-bound profile that allows the relevant Windows Hello AAGUIDs. Microsoft documents separate AAGUIDs for hardware, VBS hardware, and software authenticators.
Recommended Free Tools
- Edit or create a device-bound Passkey (FIDO2) profile.
- Use the AAGUID controls to allow the Windows Hello authenticator types your security policy accepts.
- For higher assurance, allow only the hardware-backed or VBS-hardware AAGUIDs that your managed devices use.
- Target the profile to the intended device users and test registration and sign-in.
The Windows profile cannot enforce attestation. AAGUID allowlisting is therefore the control Microsoft documents for limiting registrations to approved hardware-backed Windows Hello authenticator types.
How can Conditional Access require a passkey for sensitive resources?
Passkey availability and passkey requirement are separate decisions. The Authentication methods policy determines who may register and use a passkey; Conditional Access authentication strength determines when a particular application or resource must be accessed with one.
- Open the Conditional Access policy for the application, cloud resource, or user action that needs stronger authentication.
- Select a built-in phishing-resistant authentication strength, or create a custom authentication strength.
- In a custom strength, limit the allowed methods to Passkeys (FIDO2).
- If necessary, restrict the custom strength further by specifying approved AAGUIDs.
- Apply the policy to the appropriate users and applications, exclude emergency access accounts according to your documented emergency plan, and test in report-only mode before enforcement.
This lets a tenant require an approved passkey for an administrative portal or other sensitive resource without forcing every sign-in for every user to use the same authenticator.
What backup methods prevent a lost passkey from causing lockout?
Require more than one strong method before relying on passkeys for important accounts. A user who has only one credential can be stranded if that key, phone, or device is lost, damaged, or unavailable.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Build a recovery set for privileged users
- Register at least two strong methods for each privileged administrator.
- Prefer phishing-resistant, device-bound FIDO2 security keys or passkeys when the role requires the highest assurance.
- Keep the additional method independent of the primary device; two credentials stored on the same lost phone do not provide the same resilience as separate devices or keys.
- Verify that the second method works before enabling a stricter Conditional Access policy.
Understand which methods work for which task
The Authentication methods policy is Microsoft’s central place for managing modern methods. Most enabled methods can support authentication and password reset, but FIDO2 and Windows Hello are authentication-only. Security questions are a legacy password-reset-only method.
| Method category | Authentication | Password reset | Administrative implication |
|---|---|---|---|
| Passkeys (FIDO2) | Yes | No | Keep another method available for recovery. |
| Windows Hello | Yes | No | Do not count it as the only SSPR recovery option. |
| Other enabled modern methods | Depends on the method and policy | Depends on the method and policy | Check the tenant’s Authentication methods policy and SSPR configuration. |
| Security questions | No | Yes, as a legacy method | Continue managing them through the legacy SSPR policy until the migration control is available. |
How should I set SSPR requirements?
Self-service password reset can require one or two authentication methods. Set the requirement with the recovery methods users actually have, and ask users to register multiple methods before increasing the threshold.
- Review which authentication methods are enabled for password reset in the SSPR policy.
- Confirm that privileged users have two usable methods, including a method that is independent of their primary passkey device.
- Set the SSPR requirement to one or two methods according to the risk and user population.
- Test a reset with a pilot account that has the expected number and types of registrations.
- Notify users before raising the requirement from one method to two.
If the requirement changes from one method to two, users who have only one registered method may be unable to reset their password until they register another. Treat that dependency as a rollout gate rather than discovering it during an outage.
How do I protect registration and administration?
Passkey policy is only as trustworthy as the account and session used to change it. Apply least-privilege role assignments and Conditional Access to both registration and administration.
- Limit authentication-method administration to Authentication Administrator or Privileged Authentication Administrator roles, assigned only to trusted personnel.
- Use Privileged Identity Management to make elevated access eligible and time-bound where appropriate.
- Protect Security info registration with Conditional Access so an attacker cannot add a new method from an unmanaged or risky session.
- Separate the people who approve privileged role assignments from the people who administer ordinary user authentication where your operating model permits.
- Log and review profile changes, group-scope changes, AAGUID changes, and new registrations.
Do not make a global passkey change while the only administrator account has a single untested authenticator. Establish the second method first, then make the policy change from a controlled session.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I migrate legacy MFA and SSPR settings?
Use Entra ID > Authentication methods > Policies as the central management surface and follow Microsoft’s authentication-method migration guidance. Consolidate legacy MFA and SSPR settings deliberately rather than enabling overlapping controls indefinitely.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Inventory the methods currently enabled in the legacy MFA and SSPR policies.
- Map each method to its Authentication methods policy setting and determine whether it supports sign-in, password reset, or both.
- Move modern methods into the central policy and define the intended user or group scope.
- Keep security questions in the legacy SSPR policy until a migration control for them is available.
- Test registration, normal sign-in, password reset, and administrator recovery for each pilot group.
- Retire conflicting legacy settings only after the new policy produces the expected behavior.
What should I check when registration or sign-in fails?
The passkey option is missing
Confirm that the user is included in an enabled profile, that self-service setup is set to Yes, and that an exclusion does not override group inclusion. If several profiles apply, check whether the credential satisfies at least one of them.
Registration is rejected by policy
Review the selected passkey type, attestation requirement, and AAGUID allowlist. A provider or authenticator can be technically supported yet still rejected because its AAGUID is not permitted.
Cross-device Authenticator registration does not complete
Check Android or iOS version, Bluetooth, internet connectivity, and access to permitted endpoints. Resolve the platform prerequisites before weakening attestation or removing restrictions.
Windows Hello is accepted on the wrong hardware
Review the Windows Hello AAGUIDs in the device-bound profile. Because the Windows profile cannot enforce attestation, restrict the profile to the hardware-backed AAGUIDs that match your assurance requirement.
A user cannot reset a password after policy changes
Check the number of methods required by SSPR and the number the user actually registered. A user with one method cannot satisfy a newly raised two-method requirement until another usable method is added.
Administrator rollout checklist
- Assign Authentication Policy Administrator to the change operator and protect the account with a second strong method.
- Create pilot, workforce, and privileged-user groups with documented owners and exclusions.
- Enable Passkey (FIDO2) profiles and set Allow self-service setup to Yes.
- Choose device-bound, synced, or both passkey types for each population.
- Set attestation and AAGUID restrictions where authenticator identity matters.
- Test synced providers against the documented macOS, iOS, Android, and browser requirements.
- Configure separate device-bound profiles for Microsoft Authenticator or Windows Hello when required.
- Use Conditional Access authentication strengths for applications that must require passkeys.
- Require at least two strong methods for privileged users and verify recovery before enforcement.
- Set SSPR to one or two methods only after confirming users can meet the selected requirement.
- Protect Security info registration and restrict authentication-method administration with least-privilege RBAC and, where appropriate, PIM.
- Record the final profile assignments, AAGUID decisions, exclusions, and recovery procedure.
Frequently Asked Questions
How can I stage a passkey rollout without locking out users?
Use a dedicated pilot group, leave self-service setup enabled, and require every pilot administrator to demonstrate a second working method before expanding scope. Keep the first Conditional Access policy in report-only mode while registration and recovery are tested, then move to enforcement after the pilot succeeds.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What should the help desk verify before assisting a locked-out administrator?
The help desk should confirm which profile and group assignment apply, identify whether the account has a second registered method, and use the documented privileged recovery path. Authentication-method changes should be performed only by personnel holding the appropriate Authentication Administrator or Privileged Authentication Administrator role.
When is it useful to allow both synced and device-bound passkeys?
Allow both when a broad workforce needs portable sign-in but a subset also needs a device-bound option. Separate the high-assurance population into its own profile or use a Conditional Access authentication strength so convenience for ordinary users does not silently become the requirement for privileged access.
What recovery test should administrators run after changing a passkey policy?
Use a pilot account to test registration, ordinary sign-in, access to a resource protected by the intended authentication strength, and password reset using the backup method. Repeat the test after changing group scope, AAGUID restrictions, attestation, or the SSPR method count, because each change can alter the available recovery path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
