Microsoft Entra External ID
AuthenticationSign In With Passkey
In brief
The documentation now points to the credential management API for signed-in customers to list, register, and delete their own passkeys with delegated permissions. It also adds a sample and warns that its deletion flow is for test tenants only.
What Entra admins need to know
No action is required. Administrators implementing this experience should review the updated API guidance and avoid deploying the sample’s high-privilege deletion flow to production.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
ms.topic: how-to
author: mmacy-msft
ms.author: marshmacy
ms.date: 10/06/24/2026
ai-usage: ai-assisted
ms.custom: it-pro, msecd-doc-authoring-1030
#customer intent: As a developer or IT admin, I want to enable passkey (FIDO2) sign-in for my external tenant so that customers can use phishing-resistant, passwordless authentication.
Step 3: Build a passkey management experience for your application
Your application needs a credential management experience so signed-in customers can register and manage their own passkeys. Use the FIDO2 provisioning APIscredential management API to build this into your app.experience with low-privilege delegated permissions.
The credential management experience should enable customers to:
- View their registered passkeys.
- Delete a passkey.
TheUse the Delete a credential method endpoint for self-service deletion with delegated permissions.
To support passkey management in your app, use the passkey credential management sample app demonstrates administrator-controlled provisioning with high-privilege application permissions.. The sample is intended for testing onlydemonstrates how signed-in customers can list and isn't an implementation model for customer self-service.
User experience
Are there low-privilege APIs for building aregister their own passkeys by using the credential management experience?
No. UseAPI with delegated permissions. Follow the FIDO2 provisioning APIssample's README to build your credential management experience.configure and run the app.
User experience
Are there low-privilege APIs for building a credential management experience?
Yes. Use the credential management API to let signed-in customers list, register, and delete their own passkeys with delegated permissions.
Can I use the same passkey across multiple domains (related origins)?
Is there an out-of-box passkey registration experience?
No. Microsoft doesn't currently provide a built-in passkey registration experience for external tenants. Build a credential management experience in your application by using the FIDO2 provisioning APIscredential management API.
Related content
@@ -5,7 +5,7 @@ ms.service: entra-external-id ms.topic: how-to author: mmacy-msft ms.author: marshmacy-ms.date: 10/06/2026+ms.date: 10/24/2026 ai-usage: ai-assisted ms.custom: it-pro, msecd-doc-authoring-1030 #customer intent: As a developer or IT admin, I want to enable passkey (FIDO2) sign-in for my external tenant so that customers can use phishing-resistant, passwordless authentication.@@ -76,7 +76,7 @@ To configure a profile: ## Step 3: Build a passkey management experience for your application -Your application needs a credential management experience so customers can register and manage their passkeys. Use the [FIDO2 provisioning APIs](/graph/api/resources/fido2authenticationmethod) to build this into your app.+Your application needs a credential management experience so signed-in customers can register and manage their own passkeys. Use the [credential management API](../../identity-platform/reference-credential-management-api.md) to build this experience with low-privilege delegated permissions. The credential management experience should enable customers to: @@ -85,7 +85,12 @@ The credential management experience should enable customers to: - View their registered passkeys. - Delete a passkey. -The [Microsoft Graph passkey sample](https://github.com/Azure-Samples/ms-identity-ciam-native-javascript-samples/tree/main/passkey-sample) demonstrates administrator-controlled provisioning with high-privilege application permissions. The sample is intended for testing only and isn't an implementation model for customer self-service.+Use the [Delete a credential method](../../identity-platform/reference-credential-management-api.md#delete-a-credential-method) endpoint for self-service deletion with delegated permissions.++To support passkey management in your app, use the [passkey credential management sample app](https://github.com/Azure-Samples/ms-identity-ciam-native-javascript-samples/tree/main/passkey-sample). The sample demonstrates how signed-in customers can list and register their own passkeys by using the credential management API with delegated permissions. Follow the sample's README to configure and run the app.++> [!IMPORTANT]+> The sample's deletion flow still uses Microsoft Graph with high-privilege application permissions and a client secret in browser code. Run the sample only in a test tenant. Don't deploy it to production. ## User experience @@ -211,7 +216,7 @@ No. Registration requires the customer's physical presence and local biometric o ### Are there low-privilege APIs for building a credential management experience? -No. Use the [FIDO2 provisioning APIs](/graph/api/resources/fido2authenticationmethod) to build your credential management experience.+Yes. Use the [credential management API](../../identity-platform/reference-credential-management-api.md) to let signed-in customers list, register, and delete their own passkeys with delegated permissions. ### Can I use the same passkey across multiple domains (related origins)? @@ -223,11 +228,11 @@ No. Passkeys aren't currently supported through native authentication APIs. Supp ### Is there an out-of-box passkey registration experience? -No. Microsoft doesn't currently provide a built-in passkey registration experience for external tenants. Build a credential management experience in your application by using the [FIDO2 provisioning APIs](/graph/api/resources/fido2authenticationmethod).+No. Microsoft doesn't currently provide a built-in passkey registration experience for external tenants. Build a credential management experience in your application by using the [credential management API](../../identity-platform/reference-credential-management-api.md). ## Related content -- [FIDO2 authentication method API reference](/graph/api/resources/fido2authenticationmethod)+- [Credential management API for Microsoft Entra External ID](../../identity-platform/reference-credential-management-api.md) - [Create a sign-up and sign-in user flow](how-to-user-flow-sign-up-sign-in-customers.md) - [Add multifactor authentication (MFA) to an app](how-to-multifactor-authentication-customers.md) - [Authentication methods in external tenants](concept-authentication-methods-customers.md)