Microsoft Entra passkeys use public key cryptography to deliver phishing-resistant, passwordless sign-in. Your credentials never leave your device.
Passkeys replace phishable methods like passwords and SMS codes with origin-bound public key cryptography — credentials that can't be replayed or shared with malicious actors.
Public key cryptography ensures credentials are bound to the legitimate site. Fake login pages can't intercept your keys.
Sign in with a glance, touch, or PIN. Face ID, fingerprint, or Windows Hello — no passwords to remember or type.
Private keys are stored in hardware security modules on your device — Secure Enclave on iOS, Android Keystore, or TPM on Windows.
Each passkey combines possession (your device) with a biometric or PIN — satisfying multi-factor requirements in a single gesture.
Built on FIDO2 and WebAuthn standards, passkeys use a challenge-response protocol that never exposes secrets.
User enters username
Entra ID sends nonce
User unlocks private key
Authenticator signs challenge
Entra verifies & grants access
The user navigates to a Microsoft Entra-protected resource and enters their username. If a passkey was previously registered, the browser activates the WebAuthn API and prompts the user to authenticate with their passkey.
Microsoft Entra supports both passkey types — choose based on your security posture and user population.
| Characteristic | Device-Bound High Security | Synced Convenient |
|---|---|---|
| Private key location | Stays on single device | Encrypted in cloud vault |
| Cross-device availability | ✕ One device only | ✓ Syncs across devices |
| Best for | Admins, regulated industries | General workforce |
| Recovery if device lost | Re-register new key | Restore from cloud backup |
| Phishing resistant | ✓ Yes | ✓ Yes |
| MFA in single gesture | ✓ Yes | ✓ Yes |
| Examples | FIDO2 Keys Windows Hello | Apple Keychain Google Password Mgr |
| Attestation support | ✓ Full | ✕ Limited |
Follow these steps in order to enable passkeys for your Microsoft Entra ID organization.
See how a passkey authentication flow feels — tap the button to simulate biometric verification.
Simulated authentication flow — no real data is sent