Free tools Windows power users keep installed
One-click scans. No signup required.
For Microsoft 365 accounts using Microsoft Entra ID, FIDO2 security keys, Windows Hello for Business, and Microsoft Entra passkeys on Windows can all support phishing-resistant sign-in—but they work differently. Choose a security key when people need a portable physical credential, Windows Hello for Business for users with managed Windows PCs, or an Entra passkey on Windows when a locally stored passkey is useful without requiring the PC to be Entra joined or registered.
How the three options differ
| Option | Where the credential lives | Best fit | Key implementation checks |
|---|---|---|---|
| FIDO2 security key | On a physical key carried by the user; connection options vary by model. | People who move between devices, shared-workstation users, or organizations issuing hardware credentials. | Enable and target Passkey (FIDO2), select a profile, and verify the key’s vendor, attestation, interface, and support on the devices people use. |
| Windows Hello for Business | A user-and-device-bound credential. The private key is protected by the device’s security modules. | People using assigned or managed Windows PCs who prefer local PIN or biometric verification. | Choose the deployment and trust model; verify device registration, identity synchronization, and any hybrid PKI needs. |
| Microsoft Entra passkey on Windows | A FIDO2 passkey in the local Windows Hello container. It is distinct from a Windows Hello for Business credential. | People who need a locally stored Windows passkey without requiring the PC to be Entra joined or registered. | Enable the applicable Entra passkey policy and profile, and explain how its credential policy differs from Windows Hello for Business. |
These options are not interchangeable. A security key is designed to travel between compatible devices. Windows Hello for Business ties a credential to a user and device. An Entra passkey on Windows uses the Windows Hello container to hold a separate FIDO2 credential; Microsoft says it can be used without Entra join or registration and can support multiple Entra accounts on one PC. See Microsoft’s passkey guidance and instructions for enabling Entra passkeys on Windows.
As an Amazon Associate I earn from qualifying purchases.
Which option should you choose?
Choose a FIDO2 security key for portability
A physical FIDO2 key is the clearest fit when a user needs to authenticate on more than one compatible device, when workstations are shared, or when an organization wants to issue a hardware credential. Check the key’s connection type against the computers and phones in use; do not assume every key works with every port, NFC reader, or tenant configuration.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Choose Windows Hello for Business for assigned Windows PCs
Windows Hello for Business suits users who sign in on a dedicated Windows device and want a local PIN or biometric experience. Its credential is device-bound, so it is not a substitute for a portable key when users move among machines. The deployment must also match the organization’s cloud, hybrid, or on-premises identity and resource-access design.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Consider an Entra passkey on Windows for local storage without device join
This is a separate FIDO2 credential stored in the Windows Hello container, not simply another name for Windows Hello for Business. It is relevant where a Windows-stored passkey is wanted but Entra device join or registration is not a prerequisite. Administrators should communicate which credential is being enrolled and configure the matching Entra passkey policy.
There is no evidence here for a universal winner or controlled ranking of usability. Base the decision on device portability, the user’s verification experience, platform coverage, replacement and recovery procedures, and the policy and attestation controls the organization needs.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What administrators need to configure
Enable and target Passkey (FIDO2)
- In the Microsoft Entra admin center, open Authentication methods > Passkey (FIDO2).
- Enable the method and target the relevant users or groups.
- Select the appropriate profile and save the configuration.
- If approved hardware is required, check Microsoft’s current FIDO2 security-key compatibility guidance, including vendor attestation requirements and eligible models. Then test enrollment with the actual key and devices users will use.
Microsoft’s labels and eligible models can change, so confirm the current settings and compatibility guidance in your tenant before rollout.
Select the Windows Hello for Business architecture
Microsoft distinguishes cloud-only, hybrid, and on-premises deployments. Its planning guidance lists cloud-only Windows Hello for Business without a PKI requirement. For hybrid deployments, cloud Kerberos trust is listed without certificates, while key trust and certificate trust require PKI. Hybrid identity synchronization and the relationships between users, devices, and registered identities also matter. Do not select a trust model without accounting for the directories and resources users must access; consult Microsoft’s Windows Hello for Business deployment planning guide.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check licensing against the capabilities you plan to use
Microsoft says Entra registration and passwordless sign-in do not require a license, but recommends Entra ID P1 for the full deployment capabilities described in its passwordless authentication deployment guidance, including Conditional Access enforcement and authentication-method activity reporting. Verify the tenant’s actual entitlements before relying on those capabilities.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Plan enrollment, recovery, and rollout
Phishing-resistant credentials address credential phishing and interception, but the authentication method alone does not complete a deployment. Traditional SMS, email one-time codes, and push approvals have risks including interception, spoofing, and fatigue, as Microsoft explains in its phishing-resistant MFA guidance. Organizations still need a practical enrollment and recovery plan.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Decide which users and devices are in scope, and confirm that keys, PCs, ports, biometrics, or PIN options match their work patterns.
- Test enrollment and sign-in with the intended profiles, devices, and representative user accounts before broad rollout.
- Define how users regain access if a key is lost, a device is replaced, or a credential cannot be used. Ensure recovery does not quietly undermine the phishing-resistant policy.
- Set and communicate any fallback methods, accounting for their differing security properties and the tenant’s policy capabilities.
- Give users clear instructions for the credential they are enrolling: a portable key, a device-bound Windows Hello for Business credential, or an Entra passkey in the Windows Hello container.
Microsoft lists other passwordless approaches—including Microsoft Authenticator passkeys, synced passkeys, and certificate-based authentication—so these three choices are not the complete set of Entra options. The right scope depends on the tenant’s policy, licensing, device fleet, and recovery requirements.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
