Enable passkeys in Microsoft Entra ID, pilot them with a group, and help staff register a phishing-resistant sign-in method.
Before you begin
Passkeys are enabled in Microsoft Entra ID, which handles sign-in for Microsoft 365 work accounts. An Authentication Policy Administrator must configure the method. Choose a small pilot group and decide whether to allow device-bound, synced, or both kinds of passkey. Check that users have compatible devices and an existing MFA method for registration.
Enable passkeys for a pilot group
- Sign in to the Microsoft Entra admin center with an account that can manage authentication methods.
- Open Entra ID → Security → Authentication methods → Policies → Passkey (FIDO2). If your tenant offers passkey profiles, opt in and review the Default profile; Microsoft says this opt-in cannot be reversed.
- On Configure, enable Allow self-service set up. Select the allowed passkey types in the profile, then save.
- Open Enable and Target, add the pilot group, assign the appropriate passkey profile, and save. Avoid a broad rollout until pilot registration and recovery have been tested.
Help a user register
Ask a pilot user to open Microsoft Security info at https://mysignins.microsoft.com/security-info, sign in with their existing MFA method, choose Add sign-in method → Passkey, and follow the prompts for their device or security key. The exact prompts depend on the operating system and passkey provider. Microsoft requires a recent MFA check before registration.
Check and expand
Have the user sign out and test a fresh Microsoft 365 sign-in with the passkey. Confirm that their alternate recovery method still works. Review the pilot experience before targeting more groups. If you later restrict a key model or provider, previously registered passkeys can stop working; plan changes carefully.
Sources
Microsoft Learn: Enable passkeys in Entra ID; Microsoft Learn: Register a passkey with a security key.
