Microsoft Entra Adds Windows Passkey Support via Windows Hello

Microsoft is rolling out passkey support for Microsoft Entra on Windows devices, enabling phishing-resistant, passwordless sign-in using Windows Hello (face, fingerprint, or PIN). The capability is opt-in and is scheduled to enter public preview from mid-March through late April 2026 for worldwide tenants, with government cloud environments (GCC, GCC High, DoD) following in a later window. A key security impact is that Entra passkeys extend passwordless authentication to unmanaged Windows devices (e.g., personal/shared endpoints) that previously often fell back to passwords.

Microsoft states the passkeys are device-bound and stored in the Windows Hello container; they are cryptographically bound to the device and not transmitted over the network, reducing exposure to credential phishing and certain malware-based theft scenarios used to bypass MFA. Each Entra account registers its own passkey per device (multiple accounts can coexist on one machine), but passkeys do not sync across devices, requiring separate registration per device. For preview enrollment, administrators must enable the Passkeys (FIDO2) authentication method in Entra Authentication Methods policies, create a passkey profile with the required Windows Hello AAGUIDs, and assign it to the appropriate groups.