Microsoft Entra External ID
AuthenticationSign In With Passkey
In brief
The documentation now describes using the preview credential management API with delegated permissions so signed-in customers can list, register, and delete their own passkeys. It also clarifies that the sample uses high-privilege administrator provisioning and is for testing.
What Entra admins need to know
No administrator action is required. Review the permissions guidance if implementing passkey management in customer applications.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
[!INCLUDE applies-to-external-only]
This article explains howPasskeys give customers a phishing-resistant way to enable passkeys (FIDO2) as a sign-sign in method for yourto consumer applications built on Microsoft Entra External ID. Passkeys let your customers sign in withCustomers can use face, fingerprint, PIN, or a security key,key instead of remembering passwords or entering one-time codes. They provide phishing-resistant authentication.
In an external tenant, you can use passkeys in two ways:
- An account with at least the Authentication Policy Administrator role to configure passkey policies.
- A custom URL domain configured for your tenant. Passkeys are registered against the custom URL as the relying party.
- A sign-up and sign-in user flow associated with your application.
- An app that's
registeredregistered in your external tenant and added to the sign-up and sign-in user flow.
End-user requirements
Step 3: Build a passkey management experience for your application
Your application needs a credential management experience so signed-in customers can register and manage their own passkeys. Use the FIDO2 provisioning APIspreview credential management API to build this into your app.experience with low-privilege delegated permissions.
The credential management experience should enable customers to:
- View their registered passkeys.
- Delete a passkey.
For a complete reference implementation, see theThe Microsoft Graph passkey sample. demonstrates administrator-controlled provisioning with high-privilege application permissions. The sample is a React single-page application (SPA) that demonstrates how to sign in users with Microsoft Entra External IDintended for testing only and manage passkey credentials by using the Microsoft Graph API.isn't an implementation model for customer self-service.
User experience
Are there low-privilege APIs for building a credential management experience?
Not yet. Low-privilege credential management APIs forYes. Use the preview credential management API to let signed-in customers list, register, and delete their own passkeys are on the roadmap. Currently, use the FIDO2 provisioning APIs to build your credential management experience.with delegated permissions.
Can I use the same passkey across multiple domains (related origins)?
Is there an out-of-box passkey registration experience?
No. There isnMicrosoft doesn't currently provide a built-in passkey registration experience provided by Microsoft at this time. You need to build your ownfor external tenants. Build a credential management experience in your application by using the FIDO2 provisioning APIspreview credential management API. An out-of-box registration experience is coming soon.
Related content
@@ -3,9 +3,11 @@ title: Sign in with passkeys in Microsoft Entra External ID description: Learn how to enable passkeys (FIDO2) for phishing-resistant, passwordless sign-in in your consumer and business customer apps using Microsoft Entra External ID. ms.service: entra-external-id ms.topic: how-to-ms.date: 05/21/2026+author: mmacy-msft+ms.author: marshmacy+ms.date: 07/23/2026 ai-usage: ai-assisted-ms.custom: it-pro+ms.custom: it-pro, msecd-doc-authoring-1017 #Customer intent: As a developer or IT admin, I want to enable passkey (FIDO2) sign-in for my external tenant so that customers can use phishing-resistant, passwordless authentication. --- @@ -13,7 +15,7 @@ ms.custom: it-pro [!INCLUDE [applies-to-external-only](../includes/applies-to-external-only.md)] -This article explains how to enable passkeys (FIDO2) as a sign-in method for your consumer applications built on Microsoft Entra External ID. Passkeys let your customers sign in with face, fingerprint, PIN, or a security key, instead of remembering passwords or entering one-time codes. They provide phishing-resistant authentication.+Passkeys give customers a phishing-resistant way to sign in to consumer applications built on Microsoft Entra External ID. Customers can use face, fingerprint, PIN, or a security key instead of remembering passwords or entering one-time codes. In an external tenant, you can use passkeys in two ways: @@ -26,7 +28,7 @@ In an external tenant, you can use passkeys in two ways: - An account with at least the [Authentication Policy Administrator](/entra/identity/role-based-access-control/permissions-reference#authentication-policy-administrator) role to configure passkey policies. - A [custom URL domain](how-to-custom-url-domain.md) configured for your tenant. Passkeys are registered against the custom URL as the relying party. - A [sign-up and sign-in user flow](how-to-user-flow-sign-up-sign-in-customers.md) associated with your application.-- An app that's [registered](how-to-register-ciam-app.md) in your external tenant and added to the sign-up and sign-in user flow.+- An app that's [registered](../../identity-platform/quickstart-register-app.md) in your external tenant and added to the sign-up and sign-in user flow. ### End-user requirements @@ -74,7 +76,7 @@ To configure a profile: ## Step 3: Build a passkey management experience for your application -Your application needs a credential management experience so customers can register and manage their passkeys. Use the [FIDO2 provisioning APIs](https://aka.ms/fido2provisioningapi) to build this into your app.+Your application needs a credential management experience so signed-in customers can register and manage their own passkeys. Use the preview [credential management API](../../identity-platform/reference-credential-management-api.md) to build this experience with low-privilege delegated permissions. The credential management experience should enable customers to: @@ -83,7 +85,7 @@ The credential management experience should enable customers to: - View their registered passkeys. - Delete a passkey. -For a complete reference implementation, see the [passkey management sample app on GitHub](https://github.com/Azure-Samples/ms-identity-ciam-native-javascript-samples/tree/main/passkey-sample). The sample is a React single-page application (SPA) that demonstrates how to sign in users with Microsoft Entra External ID and manage passkey credentials by using the Microsoft Graph API.+The [Microsoft Graph passkey sample](https://github.com/Azure-Samples/ms-identity-ciam-native-javascript-samples/tree/main/passkey-sample) demonstrates administrator-controlled provisioning with high-privilege application permissions. The sample is intended for testing only and isn't an implementation model for customer self-service. ## User experience @@ -209,7 +211,7 @@ No. Registration requires the customer's physical presence and local biometric o ### Are there low-privilege APIs for building a credential management experience? -Not yet. Low-privilege credential management APIs for passkeys are on the roadmap. Currently, use the [FIDO2 provisioning APIs](https://aka.ms/fido2provisioningapi) to build your credential management experience.+Yes. Use the preview [credential management API](../../identity-platform/reference-credential-management-api.md) to let signed-in customers list, register, and delete their own passkeys with delegated permissions. ### Can I use the same passkey across multiple domains (related origins)? @@ -221,11 +223,11 @@ No. Passkeys aren't currently supported through native authentication APIs. Supp ### Is there an out-of-box passkey registration experience? -No. There isn't a built-in passkey registration experience provided by Microsoft at this time. You need to build your own credential management experience using the [FIDO2 provisioning APIs](https://aka.ms/fido2provisioningapi). An out-of-box registration experience is coming soon.+No. Microsoft doesn't currently provide a built-in passkey registration experience for external tenants. Build a credential management experience in your application by using the preview [credential management API](../../identity-platform/reference-credential-management-api.md). ## Related content -- [Passkey management sample app on GitHub](https://github.com/Azure-Samples/ms-eeid-passkey-sample-app)+- [Credential management API for Microsoft Entra External ID](../../identity-platform/reference-credential-management-api.md) - [Create a sign-up and sign-in user flow](how-to-user-flow-sign-up-sign-in-customers.md) - [Add multifactor authentication (MFA) to an app](how-to-multifactor-authentication-customers.md) - [Authentication methods in external tenants](concept-authentication-methods-customers.md)