How to Enable Microsoft Entra Passkey on Windows

Introduction

Microsoft Entra passkey on Windows lets you register a device-bound passkey directly in the local Windows Hello container, to sign in to Microsoft Entra ID with Windows Hello biometrics or PIN, without the device being joined or registered to Entra ID. Worldwide and GCC rollout finished mid-June 2026, and GCC High and DoD rollout has been underway since early October 2026, with completion expected by the end of October 2026.

Check the article on activating Microsoft 365 Passkey HERE, which covered the general activation of the Passkey (FIDO2) method. This new capability builds on that same method, adding Windows Hello as a supported passkey provider.

Prerequisites

Required licenses

Microsoft 365 (any edition supporting modern authentication).

Administrator role

An account with the Global Administrator or Authentication Policy Administrator role to configure the passkey profile.

Other

a Windows 10 or Windows 11 PC, on a device supporting Windows Hello.
The Passkey (FIDO2) authentication method enabled.

Step 2 : Configure the passkey profile for Windows Hello

In the left-hand menu, click Authentication methods, then Passkey (FIDO2), and Configure.

Click Add profile, select Device-bound as the passkey type, and add the Windows Hello AAGUID via Add AAGUID.

note

The profile must not enforce attestation (Enforce attestation disabled), otherwise Windows passkey registration fails.

Validate the result

Once the profile is saved, each user can register a Windows passkey from My Sign-Ins, by signing in at https://mysignins.microsoft.com/security-info, and choosing Add sign-in method, then Passkey. The passkey is then created and stored in the device’s local Windows Hello container.

To sign in afterward, the user opens a Microsoft Entra ID resource, selects Face, fingerprint, PIN, or security key as the sign-in method, then validates with Windows Hello.

warning

If a Windows Hello for Business credential already exists for the same account on the device, Windows passkey registration fails. These two methods can’t coexist for the same account in the same Windows Hello container.

What sets this method apart from Windows Hello for Business

Registration : Initiated by the user, with no device join or registration required, unlike Windows Hello for Business, which provisions automatically during device enrollment.
Device sign-in : Not supported. Windows passkey only enables sign-in to Microsoft Entra ID, not Windows session sign-in or the associated SSO.
Management : Driven by Entra ID’s Authentication methods policy, not by Microsoft Intune or a Group Policy.
Multiple accounts : A single Windows device can store a separate passkey for several Microsoft Entra accounts.

Conclusion

You now know how to enable Microsoft Entra passkey on Windows, to allow a phishing-resistant sign-in on personal, shared, or non-Entra-joined devices.

Sources

Microsoft Learn - Enable Microsoft Entra passkey on Windows

Microsoft Learn - Register a Microsoft Entra passkey on Windows

Microsoft Learn - Sign in with a Microsoft Entra passkey on Windows

Did you enjoy this post ? If you have any questions, comments or suggestions, please feel free to send me a message from the contact form.

Don’t forget to follow us and share this post.

Tags :

Email verification of external Teams participants

Maxime Hiez
Teams
19 Nov, 2024

Introduction Microsoft Teams Premium introduces a new feature to enhance the security and reliability of your meetings: email verification for external participants. This feature allows m

How to activate Microsoft 365 Passkey in Entra ID

Introduction Microsoft 365 Passkey is an authentication method that replaces passwords with more secure options like facial recognition, fingerprint, or a PIN.Prerequisites **<

How to sign in with Passkey to Microsoft 365

Introduction Microsoft 365 Passkey is an authentication method that replaces passwords with more secure options like facial recognition, fingerprint, or a PIN.Prerequisites **<

How to enable LAPS on the MTR Admin account via Intune

Introduction Microsoft's LAPS (Local Administrator Password Solution) is a free tool designed to improve password security for local administrator accounts on workstations, servers and

Impact analysis of Entra ID conditional access policies

Maxime Hiez
Entra ID
17 Mar, 2025

Introduction Conditional access in Entra is a security policy that allows administrators to control access to applications and resources based on specific conditions. These conditions can i

How to create a Windows local admin account via Intune LAPS

Introduction I wrote an article last February on how to replace the password of your MTR's local account using LAPS (Local Administrator Password Solution) in Intune. I concluded my article

New security approach for non-compliant emails

Maxime Hiez
Defender
07 Apr, 2025

Introduction Microsoft has announced a major update to Defender for Office 365 that strengthens email security by improving the handling of non-RFC compliant emails. This initiative is

Blocking screenshots during Teams meetings

Maxime Hiez
Teams
12 May, 2025

Introduction Microsoft Teams continues to strengthen the privacy and security of online meetings. Starting in July 2025, a new feature will be rolled out to prevent screenshots during meeti

"Anti-Tampering" certification for Defender for Endpoint (2025)

Maxime Hiez
Defender
16 May, 2025

Introduction Microsoft recently announced that Microsoft Defender for Endpoint has successfully passed the 2025 anti-tampering tests conducted by AV-Comparatives, a recognized independe

How to enable DLP for Teams with Purview

Introduction In a context where sensitive data, particularly banking information, is increasingly circulating in collaborative tools, businesses must be extra vigilant to avoid accidental o

How to enable DLP for Outlook with Purview

Introduction Last week, I showed you how to enable DLP for Teams with Microsoft Purview to prevent accidental or malicious data leaks (Data Loss Prevention). Purview is a comprehensive

Entra Private Access for Domain Controllers

Maxime Hiez
Entra ID
22 Aug, 2025

Introduction Microsoft has announced the Public Preview of Microsoft Entra Private Access for Active Directory Domain Controllers, a major step forward in strengthening the security of

How to activate Defender EDR in "Block Mode"

Introduction In a context of constantly evolving cyber threats, antivirus solutions are no longer sufficient to effectively protect workstations. Microsoft Defender for Endpoint's *Block

How to enable DSPM for AI with Purview

Introduction With the rise of generative AI models, the phenomenon of Shadow AI (the use of artificial intelligence tools and services not approved or controlled by organizations) is incr

How to block a website URL in Edge with Defender

Introduction Web browsing is one of the most common attack vectors in business environments. To strengthen security, Microsoft Defender for Endpoint offers a powerful feature : blocking m

How to enable DLP for cloud storage with Purview

Introduction A few months ago, I showed you how to enable DLP for Outlook with Microsoft Purview to prevent accidental or malicious data leaks (Data Loss Prevention). Purview is a com

Extend Zero Trust to AI agent identities in Entra ID

Maxime Hiez
Entra ID
30 Jan, 2026

Introduction AI agents are becoming increasingly widespread in businesses (incident summaries, log analysis, flow execution, etc.), and it is crucial that their access is continuously evalu

How to enable DLP for printing with Purview

Introduction A few weeks ago, I showed you how to enable DLP to prevent the copying of financial data to an external cloud storage solution using Microsoft Purview, in order to prevent

How to enable DLP for AI websites with Purview

Introduction Last week, I showed you how to enable DLP to prevent printing of financial data using Microsoft Purview, in order to prevent accidental or malicious data leaks (*Data Loss

How to enable DLP for copy/paste with Purview

Introduction Last month, I showed you how to enable DLP to prevent financial data from being sent to an AI website using Microsoft Purview, in order to prevent accidental or malicious d

Purview Sensitivity Labels are coming to OneNote

Maxime Hiez
Purview
13 Mar, 2026

Introduction Good news for security and compliance teams, Sensitivity Labels are now General Availability in OneNote. This update finally allows you to apply the same classification a

How to block Teams calls and chats with Purview IB

Introduction Microsoft Purview's Information Barriers allow you to restrict communication and collaboration between specific user groups within a Microsoft 365 environment. Their prim

External MFA is now available in Entra ID

Maxime Hiez
Entra ID
27 Mar, 2026

Introduction Microsoft has announced the General Availability of External MFA, in Microsoft Entra ID, formerly known as External Authentication Methods. This feature allows the use

How to create Sensitivity Labels for emails in Purview

Introduction Emails remain one of the primary vectors for information leaks in businesses. Whether it's a message sent to the wrong recipient, an attachment forwarded without proper oversig

How to secure your emails with Sensitivity Labels

Introduction Last week, I showed you how to create Sensitivity Labels to secure your emails, without explaining how they work. Today I'll talk about how to use them and what results you g

Detect exposed passwords in plain text with Purview

Maxime Hiez
Purview
21 Apr, 2026

Introduction In a Microsoft 365 environment, data breaches aren't limited to credit card numbers or personal information. A frequently underestimated risk is the sharing of passwords in p

Microsoft raises the conditional access policy limit

Maxime Hiez
Entra ID
21 May, 2026

Introduction Microsoft quietly raises the limit of conditional access policies per tenant, from 195 to 244. This limit applies to all policies, whether active, disabled, or in *report-onl

How to create Sensitive Information Types in Purview

Introduction In previous articles, we examined how Microsoft Purview can protect sensitive data through DLP (Data Loss Prevention) policies and Sensitivity Labels. However, all thes

Purview Sensitivity Labels now support security groups

Maxime Hiez
Purview
09 Jul, 2026

Introduction Microsoft has updated the scoping of Sensitivity Labels policies in Microsoft Purview, now generally available. Administrators can now include non-mail-enabled security

Bot protection in Microsoft Teams meetings

Maxime Hiez
Teams
21 Jul, 2026

Introduction AI note-taking tools like Read.ai, Fireflies.ai or Otter.ai join meetings as external participants. For organizers, this raises a real control challenge : when the lobby

Microsoft Entra Backup and Recovery finally available

Maxime Hiez
Entra ID
23 Jul, 2026

Introduction Accidentally deleting a user account, a conditional access policy, or a service principal assignment can quickly paralyze a Microsoft Entra ID tenant. Until now, no native me

How to migrate SMS and voice users to Passkey

Introduction In many Microsoft 365 tenants, SMS and voice call remain the last MFA safety net for a portion of the accounts. They are also the weakest methods against SIM swap, *interce

How to configure role expiration in Purview

Introduction In most tenants, Microsoft Purview permissions pile up. An external auditor is granted eDiscovery access for three weeks, a consultant gets the Compliance Administrator r

Shieldstral, the multimodal safety classifier from Mistral AI

Maxime Hiez
Mistral AI
17 Aug, 2026

Introduction Mistral AI announced on August 4, 2026 Shieldstral, a multimodal safety classifier meant to moderate the inputs and the outputs of a language model. The model sits before a

Reporting security concerns in Teams meetings

Maxime Hiez
Teams
21 Aug, 2026

Introduction Microsoft Teams already allows a suspicious message or call to be reported. Reporting now extends to meetings and group calls, with the MC1446794 announcement. The rollout

Vishing and synthetic media detection in Teams

Maxime Hiez
Teams
26 Aug, 2026

Introduction The Teams PowerShell 7.9.0 module introduced two parameters that were not the subject of a dedicated announcement : VoicePhishingDetection in the calling policy and *Synthe

How to launch an email attack simulation with Defender

Introduction Training your users to recognize a phishing email cannot be limited to an annual awareness session, it is a reflex that is maintained, tested and measured under realistic con

Teams tightens the rules for onmicrosoft.com tenants

Maxime Hiez
Teams
10 Sep, 2026

Introduction Microsoft is introducing an outbound external messaging limit in Teams for tenants that only use their default onmicrosoft.com domain (MOERA). The rollout begins mid-Se

Entra Connect Sync update required before September 30, 2026

Maxime Hiez
Entra ID
11 Sep, 2026

Introduction All synchronization services in Microsoft Entra Connect Sync will stop working on September 30, 2026 for tenants not on at least version 2.5.79.0. This version, released in

How to enforce email confidentiality in Exchange

Introduction The "Private" sensitivity level in Outlook is a property of the message. In transit, it is represented by the SMTP header "Sensitivity: Private", which Exchange maps to the

Why a Purview DLP policy takes days to activate

Maxime Hiez
Purview
15 Sep, 2026

Introduction A DLP (Data Loss Prevention) policy that shows "sync complete" in the Purview portal can still take several days before it actually blocks anything. The lag isn't an is

Mandatory consent before joining a Teams meeting

Maxime Hiez
Teams
16 Sep, 2026

Introduction Microsoft Teams is introducing mandatory consent before entering a meeting, with the announcement MC1454114. Administrators can now require every participant to accept cust

Teams limits transcript access via Graph

Maxime Hiez
Teams
23 Sep, 2026

Introduction Microsoft introduced a control that limits Microsoft Graph applications' and agents' access to Teams meeting transcripts, with the announcement MC1393806. This control

Status update on restoring a destroyed Microsoft 365 tenant

Maxime Hiez
Microsoft 365
01 Oct, 2026

Introduction Backing up a single Microsoft 365 workload is a solved problem. Restoring a complete tenant after an attack that destroys both data and configuration is not. The question is

How to sign in to M365 apps with an external passkey

Introduction Microsoft announced the general availability of browser authentication for external identity providers in Entra ID. For domains federated through WS-Fed or SAML 2.0, th

Purview network DLP in Entra Global Secure Access

Maxime Hiez
Purview
13 Oct, 2026

Introduction Microsoft Purview has been rolling out, since late September 2026, the general availability of Network Data Security, the integration that extends DLP (*Data Loss Prevent

How to enable cross-tenant message recall in Exchange

Introduction Cloud message recall has so far only worked within a single tenant. Cross-Tenant Message Recall extends this capability to trusted organizations : a sender from an authorized

How to block the creation of AI agent identities in Entra ID

Introduction Starting November 4, 2026, any default user (without a built-in or custom role in Entra ID) will be able to create agent blueprints, unless an administrator has explicitly

How to Enable Microsoft Entra Passkey on Windows

Introduction

Prerequisites

Step 1 : Sign in to the Microsoft Entra Admin Center

Step 2 : Configure the passkey profile for Windows Hello

Validate the result

What sets this method apart from Windows Hello for Business

Conclusion

Sources

Tags :

Share :

Related Posts