Microsoft's recent announcement of expanded passkey (FIDO2) support in Microsoft Entra ID marks a significant advancement in the realm of passwordless authentication. This development, set to roll out globally from mid-October to mid-November 2025, underscores the company's commitment to enhancing enterprise security and user convenience.
Introduction to Passkeys and FIDO2
Passkeys, based on the FIDO2 standard, offer a robust, phishing-resistant authentication method. They utilize public-private key cryptography, ensuring that authentication credentials are unique to each user and service. This approach effectively mitigates common security threats associated with traditional passwords, such as phishing and credential stuffing attacks.
Key Features of the Update
The forthcoming update introduces several pivotal features:
- Group-Based Passkey Profiles: Administrators can now configure passkey authentication policies at a granular, group-based level. This flexibility allows organizations to specify which user groups are permitted to use particular FIDO2 security key models or passkeys stored in the Microsoft Authenticator app. For instance, one department might be restricted to using company-issued hardware keys, while another could utilize device-bound passkeys on mobile devices. These settings will be accessible via the Microsoft 365 admin center under Security > Authentication methods > Passkey (FIDO2) settings.
- Expanded Device and Platform Support: Passkey support now extends across Windows, macOS, Android, and iOS platforms, covering both web and native applications. Notably, device-bound passkeys can be securely stored in the Microsoft Authenticator app on iOS and Android, catering to organizations with stringent security requirements. This ensures that private keys remain on managed devices, reducing risks associated with device loss or compromise. Additionally, Microsoft Entra ID will accept any WebAuthn-compliant security key or passkey provider when attestation enforcement is disabled, broadening compatibility and allowing organizations to use a wider range of security keys and passkey providers for registration and authentication.
- API Enhancements: The update introduces changes to the API schema, enabling more advanced configurations and integrations for organizations that manage authentication through Microsoft Graph API or third-party tools. This enhancement facilitates seamless integration and management of authentication methods within existing infrastructures.
The rollout will be automatic, requiring no immediate action from administrators. However, organizations are encouraged to review their current passkey configurations, inform IT staff of the changes, and update internal documentation to reflect the new capabilities. During the public preview, any modifications made via the Microsoft Azure or Entra portal will adopt the new schema, while changes through Graph API or third-party tools will retain the existing schema until general availability.
End users will notice updates in the sign-in experience, with the term “passkey” now encompassing credentials from hardware keys, computers, and mobile devices. This unification simplifies the authentication process and aligns with Microsoft’s broader strategy to phase out traditional passwords in favor of more secure, phishing-resistant methods.
Strategic Implications
Microsoft’s expansion of passkey support in Entra ID is part of a broader industry shift toward passwordless authentication, aiming to enhance security and user experience. The company has signaled ongoing investments in both device-bound and, eventually, synced passkeys for enterprise accounts. This move reflects a commitment to staying ahead of evolving security threats and meeting the needs of modern enterprises.
Conclusion
The introduction of expanded passkey support in Microsoft Entra ID represents a significant step forward in the journey toward passwordless authentication. By offering flexible, secure, and user-friendly authentication methods, Microsoft is empowering organizations to bolster their security postures while enhancing user convenience. As this feature moves from public preview to general availability, it is poised to become a cornerstone of modern enterprise security strategies.
Source: GBHackers News Microsoft Entra ID Adds Passkey (FIDO2) Support in Public Preview
