![\"Microsoft](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/04\/Hacking_login.jpg\")
<\/p>\n<\/p>\n
Microsoft will roll out passkey support for phishing-resistant passwordless authentication to Microsoft Entra\u2011protected resources from Windows devices starting late April.<\/p>\n
The feature is expected to reach general availability by mid-June 2026 and will also extend passwordless sign-in to unmanaged Windows devices.<\/p>\n
Microsoft says that Entra passkeys on Windows will support corporate, personal, and shared devices, with admin controls via Conditional Access and Authentication Methods policies.<\/p>\n
“Users can create device\u2011bound passkeys stored in the Windows Hello container and authenticate using Windows Hello methods (face, fingerprint, or PIN),” Microsoft said<\/a> in a message center update.<\/p>\n “This expands passwordless authentication support to Windows devices that aren’t Microsoft Entra\u2011joined or registered, helping organizations strengthen security and reduce reliance on passwords across corporate\u2011managed, personal, and shared device scenarios.”<\/p>\n The new security feature will be available in organizations that have enabled ‘Microsoft Entra ID with passkeys’ in the ‘Authentication Methods policy’ for users who sign in to Windows devices that are not Microsoft Entra\u2011joined or registered, provided Conditional Access policies allow it (e.g., from corporate\u2011managed, personal, or shared devices).<\/p>\n It also\u00a0enables the creation of FIDO2 passkeys stored in a secure local credential container that can only be used for authentication to Microsoft Entra ID via Windows Hello using facial recognition, fingerprint, or PIN (unlike Windows Hello for Business, which also enables device sign-ins).<\/p>\n Feature
Additionally, passkeys are cryptographically bound to each device and never transmitted over the network, so attackers can’t steal them during phishing or malware attacks to bypass multifactor authentication.<\/p>\n While Microsoft didn’t share why this feature was added, Microsoft Entra passkeys on Windows close a security gap that previously left personal and shared devices reliant on password-based Microsoft Entra ID authentication.<\/p>\n In recent months, threat actors have heavily targeted<\/a> Microsoft Entra single sign-on (SSO) accounts using stolen credentials<\/a> in a wave of recent SaaS data-theft attacks<\/a>.<\/p>\n BleepingComputer reached out to Microsoft for more details, but a response was not immediately available.<\/p>\n In October 2024, Microsoft said it would also improve security across Entra tenants by making multifactor authentication (MFA) registration mandatory<\/a> when security defaults are enabled, as part of the company’s Secure Future Initiative<\/a>, launched in November 2023, to boost cybersecurity protection across its products.<\/p>\n Additionally, Microsoft announced in May 2025 that all new Microsoft accounts will be “passwordless by default”<\/a> to protect them against brute-force, credential stuffing, and phishing attacks.<\/p>\n![\"image\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/04\/as-tour-the-platform-970-x250.jpg\")
<\/a><\/p>\n
\n\t\t\tMicrosoft Entra passkey on Windows
\n\t\t\tWindows Hello for Business
\n\t\tStandard base
\n\t\t\tFIDO2
\n\t\t\tFIDO2 for authentication, first-party (1P) protocol for device sign-in
\n\t\tRegistration
\n\t\t\tUser-initiated, doesn’t require device join or registration
\n\t\t\tAutomatically provisioned on some Microsoft Entra joined or registered devices during device registration
\n\t\tDevice sign-in and single sign-on (SSO)
\n\t\t\tN\/A
\n\t\t\tEnables device sign-in and SSO to Microsoft Entra-integrated resources after device sign-in
\n\t\tCredential binding
\n\t\t\tBound to the device and stored in the local Windows Hello container. Users can register multiple passkeys for multiple work or school accounts on the same device.
\n\t\t\tPrimarily a device-bound sign-in method linked to device trust. The credential is tied only to the work or school account used to register the device.
\n\t\tManagement
\n\t\t\tMicrosoft Entra ID Authentication methods policy
\n\t\t\tMicrosoft Intune
\n\t\t\tGroup Policy
<\/p>\n
![\"article](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/04\/autonomous-validation2.jpg\")