Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To configure passkeys in Microsoft Entra ID, open Entra ID > Security > Authentication methods > Policies, enable Passkey (FIDO2) profiles, choose which passkey types and authenticators to allow, and target the policy to the intended users or groups. For resilience, plan recovery at the same time: ask users—especially privileged users—to register multiple strong methods, configure self-service password reset (SSPR) deliberately, and protect registration and policy administration with appropriate access controls.
What should administrators decide before enabling passkeys?
Passkeys are not a single uniform policy choice. Microsoft Entra ID profiles let administrators decide whether users may register device-bound passkeys, synced passkeys, or both; whether to check authenticator attestation; and whether to restrict authenticators using AAGUIDs. Group targeting and Conditional Access authentication strengths add further control over who can register a passkey and where a passkey is required.
Before changing policy, decide which users need passkeys, what level of assurance their roles require, which platforms the organization supports, and how users will recover if one method becomes unavailable. A practical starting point is to offer synced passkeys to appropriate workforce groups for portability, while using device-bound passkeys for administrators and other high-assurance roles. Microsoft specifically advises considering device-bound passkeys, such as FIDO2 security keys or Microsoft Authenticator, for admins and highly privileged users.
- Scope: Start with all users or selected groups, and account for exclusions. An excluded user is blocked even if they are also in an included group.
- Passkey type: Choose device-bound, synced, or both based on assurance needs and the supported user platforms.
- Authenticator controls: Decide whether registration should require attestation or be limited by AAGUID.
- Enforcement: Determine whether passkeys are simply available for sign-in or required for selected applications through Conditional Access.
- Recovery: Set a registration expectation for multiple methods before making SSPR requirements stricter.
Passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free; Microsoft says no extra licenses are required for passkeys.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I enable passkey profiles in Microsoft Entra ID?
Use the passkey profile workflow in the authentication methods policy. The administrator making the change needs at least the Authentication Policy Administrator role.
- Sign in to the Microsoft Entra admin center with an account that has at least the Authentication Policy Administrator role.
- Go to Entra ID > Security > Authentication methods > Policies, then select Passkey (FIDO2).
- Opt in to passkey profiles. Microsoft transfers existing global settings into a Default passkey profile as part of the profile workflow.
- Review the profile settings and set Allow self-service setup to Yes if users should register passkeys from Security info.
- Configure the passkey type and any assurance controls, then select the users or groups for the profile.
- On Passkey (FIDO2) > Enable and target, switch Enable on, choose All users or selected groups, select the intended profile, and save.
Plan the target carefully: exclusions take precedence over inclusion, and users can match more than one profile. When multiple profiles apply, registration and sign-in are allowed if the passkey satisfies at least one applicable profile. That means overlapping group assignments do not necessarily impose the strictest profile on a user; review overlaps when designing distinct assurance tiers.
What is the difference between device-bound and synced passkeys?
A device-bound passkey remains tied to a security key, Microsoft Authenticator, or supported device. A synced passkey is made available through a passkey provider, such as Apple Passwords, Google Password Manager, or a supported third-party provider. The choice affects portability, assurance decisions, and the platforms users need.
| Consideration | Device-bound passkey | Synced passkey |
|---|---|---|
| Where the credential is available | Tied to the security key, Authenticator, or supported device where it is bound. | Made available through the user’s passkey provider across supported contexts. |
| Portability | May require access to the specific device or key. | Provider sync can make it available on other supported devices. |
| Typical policy fit | Useful for admins and other high-assurance roles; Microsoft recommends considering device-bound options for these users. | Can support workforce convenience when the organization accepts the provider and platform requirements. |
| Controls available to administrators | Profiles can use attestation and AAGUID restrictions where supported; Windows Hello has specific AAGUID considerations. | Profiles can allow synced passkeys and be targeted to selected users or groups. |
Synced passkeys depend on the user’s platform and provider. They should not be treated as interchangeable with a device-bound credential for every role. Choose the policy that matches the assurance requirement, and document which user groups may use each type.
How do I configure synced passkeys?
Create or edit a passkey profile, allow the Synced passkey type, and target the profile to the appropriate users or groups. The administrator needs at least Authentication Policy Administrator permissions.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Open the passkey profile you intend to use under Passkey (FIDO2).
- Select Synced under Passkey type.
- Choose the users or groups that should be able to register synced passkeys, and save the profile and targeting changes.
- Tell users which supported platform and provider combinations are acceptable in your environment, then have them register from Security info.
Microsoft documents these platform requirements: Apple Passwords on macOS 13 or later and iOS 16 or later; Google Password Manager on Android 9 or later and Chrome; and supported third-party providers on the platform versions Microsoft lists. Provider support is platform-specific, so verify the relevant platform requirement rather than assuming that a provider works everywhere. For example, Microsoft names 1Password and Bitwarden among supported third-party providers on listed platform versions.
How do I configure Microsoft Authenticator passkeys?
Use a device-bound profile and allow Microsoft Authenticator as an authenticator. Microsoft lists Android 14 or later and iOS 17 or later as prerequisites for Authenticator passkeys.
- Create or edit a passkey profile and select Device-bound.
- If your policy requires authenticator verification, enable Enforce attestation.
- Where needed, configure AAGUID restrictions and add Microsoft Authenticator to the allowed list.
- Target the profile to all users or the selected groups that should use Authenticator passkeys, then save.
- For cross-device registration or authentication, ensure Bluetooth and internet connectivity are available and the required endpoints are permitted.
Cross-device use has connectivity and endpoint dependencies in addition to the mobile operating-system prerequisite. If users cannot complete registration or authentication across devices, check those requirements before broadening the profile or changing its assurance settings.
How do I configure Windows Hello passkeys?
Windows Hello passkeys require a device-bound profile that allows the relevant Windows Hello AAGUIDs. Microsoft documents separate AAGUIDs for hardware, VBS hardware, and software authenticators.
The Windows profile cannot enforce attestation. If the policy requires higher assurance, administrators can instead allow only the hardware-backed AAGUIDs relevant to their requirements. Treat the AAGUID list as a policy control that must match the authenticators the organization intends to permit; allowing a broader set may admit software authenticators as well as hardware-backed ones.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When should I use attestation and AAGUID restrictions?
Use attestation when the organization needs Microsoft Entra to verify an authenticator’s make and model during registration. Use AAGUID restrictions to allow or block specific authenticator models or providers.
Attestation is evaluated at registration, not continuously. Changing the attestation setting later does not retroactively block a credential that was already registered. If a later policy change is meant to narrow which authenticators are acceptable, assess existing registrations as part of the change rather than assuming the new setting rechecks them.
AAGUID restrictions are useful when a profile should accept only a defined set of authenticators. For example, a profile can be limited to permitted models or providers, and a Conditional Access custom authentication strength can be restricted to specific AAGUIDs for selected resources. Make sure the allowed set aligns with the profile’s passkey type and the user population’s platforms.
How can I require passkeys for sensitive applications?
Use a built-in phishing-resistant authentication strength or create a custom Conditional Access authentication strength. A custom strength can be limited to Passkeys (FIDO2) and, if required, to specific AAGUIDs.
This approach lets administrators require an approved passkey type for selected applications or resources without forcing every sign-in in the tenant to use the same authenticator. It also separates two policy questions: which users may register a credential, and which resources require a particular authentication strength. Use group-targeted passkey profiles for availability and Conditional Access authentication strengths for resource-specific enforcement.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What backup methods should users register?
Build recovery around more than one strong method, especially for privileged users. Microsoft’s recovery guidance favors phishing-resistant methods and recommends device-bound FIDO2 security keys or passkeys for stronger assurance. Users should register multiple methods so they can regain access or reset a password when one method is unavailable.
The Authentication methods policy is Microsoft’s recommended central place to manage modern authentication methods. Most enabled methods can be used for authentication and password reset, but not all methods serve both purposes.
| Method category | Authentication | Password reset | Planning implication |
|---|---|---|---|
| FIDO2 and Windows Hello | Yes | No | Strong sign-in options, but do not count on them alone for password reset. |
| Most enabled modern methods | Generally available for authentication | Generally available for password reset | Confirm each method’s permitted use in the tenant’s configured policies. |
| Security questions | No | Yes; legacy method | They are password-reset-only and remain managed through the legacy SSPR policy until a migration control is available. |
For privileged users, do not rely on one passkey stored on a single device as the only route back into the account. Have a recovery plan that includes multiple registered methods and assign responsibility for keeping those methods available. The exact combination should reflect the organization’s assurance requirements and enabled methods.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should I configure SSPR without locking users out?
SSPR can require one or two methods. Users should register multiple methods before a stricter requirement takes effect, because raising the requirement from one method to two can leave users with only one registered method unable to reset their password until they add another.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Review the current SSPR requirement and the methods enabled for password reset.
- Ask users to register more than one usable method, with particular attention to administrators and other users who could be locked out of critical work.
- Only then raise the SSPR requirement from one method to two, if that is the intended policy.
- During migration, consolidate legacy MFA and SSPR settings through Entra ID > Authentication methods > Policies and follow Microsoft’s migration guidance.
- Keep in mind that security questions remain managed through the legacy SSPR policy until a migration control is available.
Separate password-reset eligibility from sign-in strength in your planning. FIDO2 and Windows Hello can provide authentication, but neither is a password-reset method according to Microsoft’s policy guidance.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
How should administrators protect passkey registration and policy changes?
Use least-privilege access for both authentication-method administration and passkey registration. Microsoft advises protecting Security info registration with Conditional Access and limiting authentication-method administration to the Authentication Administrator or Privileged Authentication Administrator roles, assigned only to trusted personnel. Use Privileged Identity Management (PIM) to elevate access where appropriate.
- Grant only the role needed for a person’s task; use Authentication Policy Administrator for passkey profile configuration where required.
- Keep authentication-method administration restricted to trusted personnel with the appropriate administrator roles.
- Protect users’ Security info registration with Conditional Access rather than treating enrollment as an unprotected self-service action.
- Use group targeting and profile boundaries to roll out passkey types to the users who need them.
- When making a policy change, account for profile overlap, exclusions, already-registered credentials, platform prerequisites, and SSPR readiness.
What configuration mistakes cause avoidable problems?
Most operational problems come from mismatched scope, unsupported platform assumptions, or treating a sign-in credential as a recovery method. Check the applicable policy and user context before loosening controls.
- A user is in an included group but cannot register: Check whether that user is also excluded. Exclusions block access even when an included group matches.
- A user matches multiple profiles: Check whether their passkey satisfies at least one applicable profile. Multiple matches do not automatically mean the strictest profile is the only one accepted.
- An existing credential remains usable after attestation settings change: Attestation is checked at registration, so a later setting change does not retroactively block credentials already registered.
- A Windows Hello credential is rejected: Review whether the device-bound profile allows the relevant Windows Hello AAGUID. The Windows profile cannot enforce attestation.
- A synced passkey option is unavailable: Verify the platform and provider combination against Microsoft’s documented requirements for the user’s device.
- Cross-device Authenticator activity fails: Check Bluetooth, internet connectivity, and whether required endpoints are permitted.
- A user cannot reset a password with a passkey: FIDO2 and Windows Hello are authentication-only; confirm that the user has a permitted password-reset method.
- Users lose SSPR access after a policy change: Check whether the SSPR requirement was raised to two methods before affected users registered a second method.
Frequently Asked Questions
Do passkeys in Microsoft Entra ID require a paid license?
No. Microsoft says Passkeys (FIDO2) are available in every Microsoft Entra ID edition, including Free, without an extra passkey license.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I remove security questions when I migrate authentication methods?
Security questions remain managed through the legacy SSPR policy until Microsoft provides a migration control for them. They are a password-reset-only legacy method, not a sign-in method.
What role is needed to create passkey profiles?
At least the Authentication Policy Administrator role is needed for passkey profile configuration. Separately, Microsoft advises restricting authentication-method administration to Authentication Administrator or Privileged Authentication Administrator roles.
Can users register a passkey themselves?
Yes, if the profile’s Allow self-service setup setting is set to Yes. Users can then register from Security info, subject to the profile targeting and other applicable policy controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
