(Updated) General Availability: Microsoft Entra passkeys on Windows

Updated July 20, 2026: We have updated the timeline. Thank you for your patience.

Introduction

Microsoft Entra passkeys on Windows will soon be Generally Available, enabling phishing‑resistant, passwordless sign‑in to Microsoft Entra‑protected resources from Windows devices.

The Public Preview of this capability was previously announced in MC1247893.

Users can create device‑bound passkeys stored in the Windows Hello container and authenticate using Windows Hello methods (face, fingerprint, or PIN). This expands passwordless authentication support to Windows devices that aren’t Microsoft Entra‑joined or registered, helping organizations strengthen security and reduce reliance on passwords across corporate‑managed, personal, and shared device scenarios.

When this will happen:

1. General Availability (Worldwide, GCC): We will begin rolling out in late April 2026 and expect to complete by mid‑June 2026.
2. General Availability (GCC High, DoD): We will begin rolling out in early October 2026 (previously early September 2026) and expect to complete by late October 2026 (previously late September).

How this affects your organization:

Who is affected:

Organizations using Microsoft Entra ID with passkeys enabled in the Authentication Methods policy whose users sign in from Windows devices, including:

1. Corporate‑managed PCs
2. Personal devices
3. Shared devices

What will happen:

With this General Availability release:

1. Microsoft Entra passkeys on Windows will no longer require explicit opt‑in through Windows Hello AAGUID allow‑listing in a passkey (FIDO2) profile.
2. This represents a change from Public Preview behavior, where administrators were required to explicitly allow Windows Hello AAGUIDs in a passkey profile for Microsoft Entra passkeys on Windows to function.
3. If your passkey profile allows device‑bound, non‑attested passkeys:
4. Users scoped to that profile will now be able to register and use Microsoft Entra passkeys on Windows by default without additional administrator configuration.
5. As a result:
6. Users in scope of passkey profiles that allow device‑bound, non‑attested passkeys may begin registering and using passkeys on Windows devices.
7. If Conditional Access policies allow:
8. Passkeys can be created and used on Windows devices that are not Microsoft Entra‑joined or registered, including personal or shared PCs.
9. Each Windows device requires separate passkey registration per Entra account.
10. Windows Hello for Business remains recommended for managed, Microsoft Entra‑joined or registered devices.
11. Passkeys on Windows supplement unmanaged or shared device scenarios and do not support device sign‑in.
12. Attestation is not currently supported for Microsoft Entra passkeys on Windows but is planned for a future update.
13. 
    

What you can do to prepare:

1. 
   

No action is required for most organizations.

If you do not want users to register or use Microsoft Entra passkeys on Windows:

1. Update the relevant passkey (FIDO2) profile to block Windows Hello AAGUIDs.
2. Review existing passkey profiles that allow device‑bound, non‑attested passkeys.
3. Add Windows Hello AAGUIDs to the block list in passkey profiles where passkey usage on Windows devices should not be permitted.
4. 
   

Learn more: Enable Microsoft Entra passkey on Windows | Microsoft Learn (will be updated before GA rollout)

Compliance considerations:

Compliance areaExplanationDoes the change modify, interrupt, or disable Conditional Access policies?Existing Conditional Access policies continue to govern whether passkeys can be created or used on unmanaged Windows devices.Does the change include an admin control and can it be controlled through Entra ID group membership?Admins can control passkey availability through Authentication Methods policies and FIDO2 passkey profiles scoped to Microsoft Entra ID groups.Does the change allow a user to enable and disable the feature themselves?Users may register Microsoft Entra passkeys on Windows devices if permitted by administrator policy configuration.