Entra ID prepares a device-bound passkey preview, with FIDO2 policy and sign-in changes

The period’s sole supplied item is a Microsoft 365 Message Center notice about a substantive Entra ID authentication change, not a general-availability announcement or a documentation clarification. Beginning in mid-March 2024, Entra ID is expected to add preview support for device-bound passkeys stored on computers and mobile devices alongside existing FIDO2 security-key support. The rollout also changes FIDO2 policy handling and makes the end-user sign-in terminology cover passkeys from all supported device types.

• Entra ID · Conditional Access

  Device-bound passkeys enter Entra ID as a preview authentication method

  Starting in mid-March 2024, Entra ID will support device-bound passkeys stored on computers and mobile devices, in addition to its existing support for FIDO2 security keys. The notice identifies this as a preview; it does not establish general availability.

• Entra ID · Conditional Access

  FIDO2 policy must permit the intended passkey providers

  To allow specified passkey providers, administrators will need to enforce key restrictions in the FIDO2 policy. This is the concrete configuration impact of extending supported credentials beyond security keys.

• Entra ID · Conditional Access

  The Windows Hello for Business and FIDO2 sign-in label becomes more inclusive

  The end-user option will be renamed to "Face, fingerprint, PIN, or security key." The updated sign-in experience will also use the term "passkey" so the wording covers passkey credentials presented from security keys, computers, and mobile devices.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.