Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID

FIDO2 security key sign-in to Windows

7 July 2026Updated+107 / −36 lines

In brief

Learn how to enable passwordless security key sign-in to Windows with Microsoft Entra ID using FIDO2 security keys.

What Entra admins need to know

Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

Open on Microsoft Learn ↗

The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.

Enable FIDO2 security key sign-in to Windows 10 and 11 devices with Microsoft Entra ID

This documentarticle focuses on enabling FIDO2 security key key-based passwordless authentication with Windows 10 and 11 devices. After completing the steps in this article, you're able to can sign in to both your Microsoft Entra ID and Microsoft Entra hybrid joined Windows devices with your Microsoft Entra account using a FIDO2 security key.

RequirementsPrerequisites for FIDO2 security keys

Unsupported scenarios

The following scenarios aren't supported:

  • Windows Server Active Directory Domain Services (AD DS) domain-joined (on-premises only devices) deployment.
  • Scenarios,Scenarios such as RDP, VDI, and Citrix, that use a security key other than webauthn redirection.
  • S/MIME using a security key.
  • Run as using a security key.
  • Signing in to a server using a security key.

Device sign-in and unlock

  • OOBE sign-in with a passkeyFIDO2 security key is supported. You can use Web sign-in to unlock a Windows device. For more information, see Use Web Sign-In To Enable Passwordless Sign-In In Windows.
  • When signing in or unlocking a Windows device using a security key that contains multiple Microsoft Entra accounts, the device defaults to the last account added to the key. However, WebAuthn allows users to select the specific account they wish to use for authentication.
  • Unlocking a device requires Windows 10 version 1809. For the best experience, use Windows 10 version 1903 or higher.

Microsoft Entra hybrid joined devices must run Windows 10 version 2004 or newer.

EnableConfigure a device-bound passkeys profile for FIDO2 security keys

A device-bound key profile allows you to define attestation and key restriction settings for Windows sign-device-bound passkeys stored on physical security keys.

  1. Sign in

    Organizations can choose to use one or more of the followingMicrosoft Entra admin center as at least an Authentication Policy Administrator.

  2. Browse to Entra ID > Authentication methods.

  3. On the Authentication methods | Policies page, select Passkey (FIDO2) > Configure.

  4. Select + Add profile.

    :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-passkey-profile.png" alt-text="Screenshot that shows how to enableadd a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-passkey-profile.png":::

  5. Enter a Name for the use ofprofile, such as FIDO2 security keys for Windows sign-in based on their organization's requirements:.

    • For Passkey types, select Device-bound and Save.

:::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/security-key-profile.png" alt-text="Screenshot that shows a passkey profile named FIDO2 security keys with Passkey types set to Device-bound." lightbox="media/how-to-authentication-passkey-profiles/security-key-profile.png":::

Example: Target specific AAGUIDs

You can target specific AAGUIDs to control which authenticators users can register. In this example, the passkey profile allows only AAGUIDs for specific models of FIDO2 security keys.

To configure this profile:

  1. Select Target specific AAGUIDs.
  2. Set Behavior to Allow.
  3. Under Model/Provider AAGUIDs, add the AAGUIDs for the FIDO2 security key models that you want to allow for sign-in, and select Save.

:::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/security-key-high-assurance-profile.png" alt-text="Screenshot that shows a passkey profile named FIDO2 security keys with Enforce attestation and Target specific AAGUIDs selected, Behavior set to Allow, and specific FIDO2 security key model AAGUIDs added." lightbox="media/how-to-authentication-passkey-profiles/security-key-high-assurance-profile.png":::

Enable and target groups for a device-bound passkey profile

Organizations can choose to use one or more of the following methods to enable the use of security keys for Windows sign-in based on their organization's requirements:

Enable with Microsoft Entra admin center

  1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.

  2. Browse to Entra ID > Authentication methods.

  3. On the Authentication methods | Policies page, select Passkey (FIDO2) > Enable and target.

  4. On the Enable and Target tab, make sure Enable is On.

  5. Select Add target, and choose All users or Select targets to choose specific groups.

    :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/add-target.png" alt-text="Screenshot that shows how to add a target for a passkey profile." lightbox="media/how-to-authentication-passkey-profiles/add-target.png":::

  6. Select the profile for device-bound passkeys.

    :::image type="content" border="true" source="media/how-to-authentication-passkey-profiles/enable-target-device-bound.png" alt-text="Screenshot that shows how to enable and target a profile for device-bound passkeys." lightbox="media/how-to-authentication-passkey-profiles/enable-target-device-bound.png":::

  7. Select Save to enable device-bound passkeys for the selected users.

Enable with Microsoft Intune

To enable the use of security keys using Intune, complete the following steps: Configuration of security keys for sign-in isn't dependent on configuring Windows Hello for Business.

Targeted Intune deployment

This Group Policy setting requires an updated version of the CredentialProviders.admx Group Policy template. This new template is available with the next version of Windows Server and with Windows 10 20H1. This setting can be managed with a device running one of these newer versions of Windows or centrally by following the guidance here: How to create and manage the Central Store for Group Policy Administrative Templates in Windows.

Sign in withProvision FIDO2 security keykeys using Microsoft Graph API (preview)

In this example,Currently in preview, administrators can use Microsoft Graph and custom clients to provision FIDO2 security keys on behalf of users. Provisioning requires the Authentication Administrator role or a user named Bala Sandhu alreadyclient application with UserAuthenticationMethod.ReadWrite.All permission. The provisioning improvements include:

  • The ability to request WebAuthn creation Options from Microsoft Entra ID
  • The ability to register the provisioned their FIDO2 security key using the steps in the previous article, Enable passwordless security key sign in. Fordirectly with Microsoft Entra hybrid joined devices, make sureID

With these new APIs, organizations can build their own clients to provision passkey (FIDO2) credentials on security keys on behalf of a user. To simplify this process, three main steps are required.

  1. Request creationOptions for a user: Microsoft Entra ID returns the necessary data for your client to provision a passkey (FIDO2) credential. This includes information such as user information, relying party ID, credential policy requirements, algorithms, registration challenge and more.
  2. Provision the passkey (FIDO2) credential with the creation Options: Use the creationOptions and a client that supports the Client to Authenticator Protocol (CTAP) to provision the credential. During this step, you also enabled passwordless security key sign-in to on-premises resources. Bala can choose the security key credential provider from the Windows 10 lock screen andneed to insert the security key to sign into Windows.

    Security key sign-in at the Windows 10 lock screen

    Manage security key biometric, PIN, or reset security key

    • Windows 10 version 1903 or higher
      • Onand set a device, users can go to Windows Settings > Accounts > Sign-in options > Security Key, and then select the Manage button.PIN.
      • Users can change their PIN, update biometrics, or reset their security keyRegister the provisioned credential with Microsoft Entra ID: Use the formatted output from the provisioning process to provide Microsoft Entra ID the necessary data to register the passkey (FIDO2) credential for the targeted user.

:::image type="content" border="true" source="media/how-to-enable-passkey-fido2/provision.png" alt-text="Diagram that shows the steps to provision passkeys (FIDO2)." :::

Troubleshooting and feedback

  • Subcategory: FIDO
  1. To capture logs, use the option to Recreate my Problem.

Next stepsRegister a FIDO2 security key

Enable access to on-premises resources for Microsoft Entra ID and Microsoft Entra hybrid joined devicesAfter an admin creates the device-bound passkey profile, users can register a FIDO2 security key on their device.

Learn more about device registrationFor registration steps, see Register a passkey with a FIDO2 security key.

Sign in with a FIDO2 security key

After registration, users can sign in to Microsoft Entra ID by using the FIDO2 security key on their device.

Learn more about Microsoft Entra multifactor authenticationFor sign-in steps, see Sign in with a FIDO2 security key.

Related content