How to enable passkey (FIDO2) profiles in Microsoft Entra ID (preview)

Passkey profiles enable granular group-based configurations for passkey FIDO2 authentication. Instead of a single tenant-wide setting, you can define specific requirements such as attestation, passkey type (device-bound or synced), or Authenticator Attestation GUID (AAGUID) restrictions. You can apply requirements in separate passkey profiles for different user groups, such as admins versus frontline staff.

What are passkey profiles?

A passkey profile is a named set of policy rules that governs how users in targeted groups can register and authenticate with passkeys (FIDO2). Profiles support advanced controls such as:

• Enforce attestation: Enabled, Disabled
• Target types: Device-bound, Synced
• Target specific authenticators: Allow or block specific authenticators by their AAGUID. For more information, see Authenticator Attestation GUID.

Before you begin

• Users must complete multifactor authentication (MFA) within the past five minutes before they can register a passkey (FIDO2).
• Users need an authenticator that supports Microsoft Entra ID's attestation requirements. For more information, see Microsoft Entra ID attestation for FIDO2 security key vendors.
• Devices must support passkey (FIDO2) authentication. For Windows devices that are joined to Microsoft Entra ID, the best experience is on Windows 10 version 1903 or higher. Hybrid-joined devices must run Windows 10 version 2004 or higher.
• If a passkey profile for both device-bound and synced passkeys targets Microsoft Authenticator, users need to run Microsoft Authenticator iOS version 6.8.37 or Android version 6.2507.4749.
• Policy size limit:
  • The Authentication methods policy supports a size limit of 20KB. You can't save more passkey profiles after the size limit is reached. To check the size, use the Get authenticationMethodsPolicy Microsoft Graph API to retrieve the JSON for the Authentication methods policy. Save the output as a .txt file, then right-click and select Properties to view the file size.
  • Reference sizes:
    • Base passkey policy without changes: 1.44 KB
    • Target with 1 applied passkey profile: 0.23 KB
    • Target with 5 applied passkey profiles: 0.4 KB
    • Passkey profile with no AAGUIDs: 0.4 KB
    • Passkey profile with 10 AAGUIDs: 0.3 KB

Enable passkey profiles (preview)

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.

2. Browse to Entra ID > Security > Authentication methods > Policies.

3. Select Passkey (FIDO2), and select Opt-in to public preview on the public preview banner to see the passkey profiles (preview).

   

   Note

   Previous Passkey (FIDO2) policy settings are automatically transferred to the Default passkey profile. Previous user targets are also automatically transferred to Enable and target.

4. To complete opting-in, select the Default passkey profile.

   

   For Target Types, select the types of passkeys that you want to allow.

   

5. Select Save.

Create a new passkey profile

1. On the Configure tab, click + Add passkey profile.

   

2. Fill out the profile details. The following table explains the impact if you enforce attestation. For other vendor attestation requirements, see Microsoft Entra ID attestation for FIDO2 security key vendors.

   Enforce attestation	No (default)	Yes
   Supported passkey types	Synced and device-bound	Device-bound only
   Passkey required to present valid attestation statement	Doesn't require a passkey to present a valid attestation statement at registration time. Microsoft Entra ID can't guarantee any attribute about a passkey, including if it's synced or device-bound, or the specific make, model, or provider, even if you select Target specific AAGUIDs. Use AAGUID lists as a policy guide rather than a strict security control when Enforce attestation is set to No.	Required at registration time so Microsoft Entra ID can verify the authenticator’s make and model against trusted metadata. Attestation assures your organization that the passkey is genuine and comes from the stated vendor. Attestation is checked only during registration; passkeys that you previously added without attestation aren’t blocked from sign-in if you enable attestation later.

   The next table describes profile target options.

   Target	Description
   Target types	You can allow device-bound passkeys, and synced passkeys if Enforce attestation is set to No.
   Target specific AAGUIDs	You can allow or block certain security key models or passkey providers, identified by their AAGUID, to control which authenticators users can use to register and sign in with passkeys. If you remove an AAGUID that you previously allowed, users who registered that passkey (FIDO2) as an allowed method can no longer use it for sign-in.

3. Select Save.

Apply a passkey profile to a targeted group

1. Select Enable and Target.

2. Select Add target and select either All users or Select targets to select groups.

   

3. Select which passkey profiles you want assigned to a specific target.

   

   Note

   A target group (for example, Engineering) can be scoped for multiple passkey profiles. When a user is scoped for multiple passkey profiles, registration and authentication with a passkey is allowed if it fully satisfies the requirement of one of the scoped passkey profiles. There's no particular order to the check. If a user is a member of an excluded group in the Passkeys (FIDO2) authentication method policy, they're blocked from FIDO2 passkey registration or sign-in. Excluded groups take precedence over Included groups.

Delete a passkey profile

1. Select Configure.

2. Select the trash can to the right of the passkey profile you want to delete, and select Save.

   Note

   You can delete a profile only if it's not assigned to a group of users in Enable and target. If the trash can is gray, first remove any targets that are assigned that profile.

   

Disable passkey profiles (preview)

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Security > Authentication methods > Policies.
3. Select Passkey (FIDO2), and select Opt-out of public preview on the public preview banner.
4. Review the conditions of opting out, and click opt-out if you accept.

Examples of use cases for passkey profiles

Special consideration for high-privileged accounts

Targeted rollout of passkeys in Microsoft Authenticator

Related content

How to enable synced passkeys (FIDO2) in Microsoft Entra ID (preview)