Passkeys for Windows and Microsoft 365

Passwords remain an awkward and vulnerable part of digital identity. People forget them, reuse them and can type them into convincing fake sign-in pages. Passkeys for Windows 11 and Microsoft 365 provide a different model based on public-key cryptography. The user approves access with Windows Hello, a device PIN, biometrics or a compatible security key; the service verifies a cryptographic proof instead of receiving a password.

That does not mean an organisation should switch on one setting and remove every fallback on the same day. A reliable rollout requires compatible devices, a recovery process, the correct Microsoft Entra ID policy and a prepared help desk. This guide covers the practical steps for home users, small businesses and IT teams, while keeping licensing, identity configuration and device management as separate decisions.

What a passkey is and how it changes sign-in

A passkey is a FIDO credential registered to a particular account and online service. Registration creates a key pair: the service stores the public key while the private key remains protected by the authenticator. At sign-in, the service sends a challenge. The authenticator signs it only after local user verification. Your fingerprint, face scan or device PIN is not sent to the website.

The credential is cryptographically bound to the legitimate service. A passkey created for a genuine domain cannot sign a challenge for a lookalike domain controlled by an attacker. Microsoft and the FIDO Alliance therefore describe passkeys as phishing-resistant credentials. They do not remove every security risk — an unlocked device, stolen session or weak account-recovery process still needs attention — but they reduce dependence on secrets that a user can disclose or an attacker can replay.

Passkeys, Windows Hello and security keys are related but different

• Passkey: the FIDO credential registered with an account or service.
• Windows Hello: the Windows capability that can protect and unlock a credential with a device PIN, face or fingerprint on compatible hardware.
• FIDO2 security key: an external authenticator, commonly using USB or NFC, that can hold a device-bound passkey.
• Synced passkey: a credential that a compatible provider can make available on other devices within its ecosystem, subject to that provider’s security controls.

The right option depends on the use case. A managed company laptop may use a Windows Hello-protected credential. A privileged administrator may carry a separate physical key. A consumer may prefer a synced passkey. Microsoft’s documentation distinguishes these models, and Microsoft Entra ID can restrict accepted authenticator types.

Requirements before you begin on Windows 11

Bring Windows 11 up to date, install current security updates and confirm that Windows Hello works. Microsoft documents passkey management under Settings > Accounts > Passkeys on supported Windows 11 versions. Availability can depend on the Windows release, account type, authenticator and organisational policy, so test the complete flow on a pilot device rather than assuming that every PC behaves identically.

Configure a Windows Hello PIN and, where supported, face or fingerprint recognition. The PIN is tied to the device and is not simply the password for the Microsoft account. In a business environment, also confirm that the device is joined or registered to Microsoft Entra as intended, that Conditional Access permits the pilot scenario and that every tester has an approved recovery method.

If you are refreshing endpoints, review the available Windows 11 licences. Licensing Windows is not the same as enabling passkeys in Entra: the operating system, Microsoft 365 service, tenant configuration and identity policy each have their own role.

How to create and use a passkey in Windows 11

1. Set up Windows Hello

1. Open Settings > Accounts > Sign-in options.
2. Create a Windows Hello PIN if one has not already been configured.
3. Add face or fingerprint recognition only when the device has compatible hardware and the organisation permits it.
4. Lock and unlock the PC to confirm that local verification works before registering new credentials.

2. Register the passkey from the service

Passkey creation normally starts on the account or application’s security page, not from the list in Windows Settings. Sign in to the legitimate service, open its security options and choose to add a passkey. Windows displays its security interface and may let you save the passkey on this device, use a phone or tablet, or use a security key, depending on the service and available authenticators.

Check the domain before approving the request. Choose Windows Hello if you want the PC to protect the passkey, complete verification with the PIN or biometrics, and assign a recognisable name if requested. Finish by signing out and testing from a fresh browser window. Keep the existing recovery method until the new sign-in has been tested properly.

3. Sign in with the passkey

At the service’s sign-in page, choose Sign-in options, Passkey or the equivalent label. Confirm the account, inspect the Windows Security prompt and use Windows Hello or touch the physical key as directed. If the passkey is held on another device, the flow may present a QR code and use Bluetooth proximity. Follow the prompts on both devices and never scan an unexpected sign-in code sent by email or chat.

4. View or delete passkeys stored in Windows

1. Go to Settings > Accounts > Passkeys.
2. Find the credential by its displayed service or account name.
3. Open its menu and delete it only after confirming another way into the account.
4. Review the service’s own security page as well. Removing a local entry and revoking a credential at the account can be separate actions.

When a PC is sold, returned or reassigned, revoke relevant credentials through the services, follow the organisation’s secure wipe process and update the asset record. Do not treat deletion from the local Passkeys settings page as the entire offboarding procedure.

Passkeys for Microsoft 365 with Microsoft Entra ID

Microsoft 365 organisations use Microsoft Entra ID to authenticate work and school accounts. Entra’s authentication methods policy includes Passkey (FIDO2). An administrator must enable the method for appropriate groups before those users can register and use passkeys for their organisational accounts.

Productivity subscriptions can be reviewed in Licendi’s Microsoft Office 365 category. Before rollout, confirm which product is being purchased, who owns the tenant, who controls the domain and who will administer identity. A commercial licence does not configure Entra policy automatically.

Microsoft Entra configuration for administrators

1. Sign in to the Microsoft Entra admin centre with a role permitted to manage authentication policy, such as Authentication Policy Administrator.
2. Open Protection > Authentication methods > Policies.
3. Select Passkey (FIDO2).
4. Enable the method and initially target a pilot group. Avoid enabling the entire organisation before end-to-end testing.
5. Under Configure, review self-service setup, attestation and key restriction policy.
6. If restrictions are required, decide whether specific AAGUIDs will be allowed or blocked. Record the identifier and model of every approved authenticator.
7. Save the policy, allow time for propagation and test with a pilot account.

Microsoft’s deployment guidance recommends a phased approach to phishing-resistant passwordless authentication. Start with users who can provide useful feedback, include help-desk staff and then expand by department. Emergency access accounts need a separate design, tightly controlled credentials and scheduled tests; they should not depend on one administrator’s personal passkey.

How a Microsoft 365 user registers a passkey

1. Open Microsoft Security info and authenticate with the work or school account.
2. Select Add sign-in method.
3. Choose Passkey, then select the option offered by policy, such as Microsoft Authenticator, a security key or another supported authenticator.
4. Follow the wizard and approve registration on the device or authenticator.
5. Give the credential a name that identifies the device or key without exposing sensitive information.
6. Run a sign-out test and use Sign-in options to access Microsoft 365 with the passkey.

Portal wording can change with language and service updates. If Passkey is missing, first confirm that the user is included in the targeted group, the method is enabled and the chosen authenticator type is not excluded. Then review registration prerequisites, Conditional Access and the device or application version.

A practical rollout plan for a small business

Phase 1: inventory and policy

Classify users, privileged accounts, endpoints and essential applications. Decide which passkeys the business will support: Windows Hello-protected credentials, physical keys, Microsoft Authenticator or a controlled combination. Write down who issues and recovers physical keys, how the help desk verifies identity and what happens when an employee loses a phone or laptop.

Document exceptions before the rollout. Shared workstations, contractors, kiosks, service accounts and older applications may need different treatment. A passkey is an interactive user credential; it does not automatically replace credentials used by a background service or a legacy protocol.

Phase 2: controlled pilot

Select a small group representing office, remote and administrative work. Keep an approved fallback during the pilot. Log incidents by device, browser, application and authenticator type. Test web sign-in, desktop Microsoft 365 applications, a replacement device, simulated loss, credential revocation and help-desk recovery.

A pilot is successful only when recovery works, not merely when the first passkey registers. Ask each tester to use the new method repeatedly over normal working days. Record confusing prompts and update internal instructions with screenshots from the actual managed environment.

Phase 3: Conditional Access and expansion

After the experience is stable, evaluate Conditional Access and authentication strengths to require phishing-resistant methods where risk justifies it. Prioritise administrators and sensitive resources, while maintaining verified emergency access. Expand in waves, communicate the change in advance and monitor sign-in logs, failed registrations, recovery cases and revoked credentials.

Phase 4: reduce password dependence

Passwordless should not mean recovery-less. Reduce exposure to passwords only after coverage, application compatibility and account recovery have been demonstrated. Review legacy authentication, old applications and service identities separately. Retain an audit trail for registrations, removals, exceptions and temporary access methods.

Common problems and troubleshooting

The Passkey option is not displayed

Update Windows and the browser, confirm that the website supports passkeys and verify that the Entra authentication methods policy includes the user. On managed endpoints, inspect applied device policies. Different services expose different registration screens, and an organisation can reject authenticator types that would otherwise work.

Windows Hello does not complete verification

Test the PIN under Sign-in options, check the camera or fingerprint reader and review corporate policy. If Windows Hello must be reset, validate associated credentials afterwards. Do not remove security methods blindly when there is no proven path back into the account.

A user loses the device or physical key

The support team should verify identity using the approved procedure, revoke the missing credential through Security info and register a replacement. If the user has another valid authenticator, that can support recovery. Avoid improvised telephone resets based only on information that is easy to discover.

An application still requests a password

The application, protocol or current session may not support the same passkey flow. Check the product documentation, update the client and inspect Entra sign-in logs. Enabling Passkey (FIDO2) does not instantly make every application and protocol in the tenant passwordless.

A QR flow fails between devices

Confirm that both devices are nearby, Bluetooth is available where the flow requires proximity, the browser is current and the QR code was generated by the legitimate sign-in page. Restart the registration rather than reusing an old screenshot. If organisational policy blocks that authenticator type, use an approved alternative.

Security and support best practices

• Register more than one approved method for critical users and test recovery.
• Protect privileged accounts with separate authenticators and stricter controls.
• Issue physical keys through an inventory and store identifiers without exposing secrets.
• Train users to verify domains and reject unexpected authentication prompts.
• Revoke credentials when employees, suppliers or managed devices are offboarded.
• Review Entra sign-in data and document temporary policy exceptions.
• Keep Windows, browsers, Authenticator and supported device firmware updated.
• Separate account recovery from routine help-desk shortcuts and require appropriate identity proof.

For multiple seats or a broader software refresh, review Licendi’s enterprise licensing service. Correct procurement helps establish a clean platform, but identity policy, endpoint management, user training and recovery remain operational responsibilities.

Frequently asked questions about passkeys

Is a passkey the same as a saved password?

No. A saved password remains a secret presented to a service. A passkey uses a cryptographic key pair: the service stores the public key and the authenticator protects the private key.

Can I use passkeys on Windows 11 without a fingerprint reader?

Yes, where the service and policy allow it. Windows Hello can verify the user with a device PIN. A compatible physical security key or another device can also be used.

Does Microsoft 365 support passkeys for business accounts?

Yes. Microsoft Entra ID provides the Passkey (FIDO2) authentication method. An administrator must enable and target it through the authentication methods policy.

What happens if I lose my laptop or phone?

Use another previously registered method or follow the organisation’s approved recovery process. Revoke the passkey associated with the missing device and register a replacement.

Do passkeys eliminate phishing completely?

They resist credential phishing because they are bound to the legitimate service, but they do not eliminate session theft, compromised endpoints, social engineering against support or weak recovery processes.

Should I remove my password as soon as I add a passkey?

No. Test sign-in and recovery across all required devices and applications first. Organisations should remove older methods gradually under an approved policy.

Conclusion: fewer passwords, stronger control

Passkeys combine a simpler sign-in experience with cryptography that avoids handing a reusable password to every service. Windows 11 supplies Windows Hello and local passkey management, while Microsoft Entra lets administrators enable Passkey (FIDO2), target groups and control accepted authenticators. The real benefit appears when these features are supported by inventory, user guidance, reliable recovery and continuing review.

Begin with a pilot, retain a tested fallback and expand only after loss and revocation scenarios work. If your organisation also needs to regularise Windows or Microsoft 365 licensing, contact Licendi for an enterprise licensing proposal and build the software foundation for the rollout.