FIDO2 security keys and passkey profiles: after Entra SMS and voice MFA retire
Short answer: Turn on Passkey (FIDO2) in the Authentication methods policy, opt in to passkey profiles, and give security key users a profile with Passkey types set to Device-bound. Use Enforce attestation and AAGUID key restrictions only when you need to limit which key models are allowed. Users register keys in Security info, or admins can provision keys for them with Microsoft Graph (preview).
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| Device-bound profile with attestation enforced | ✓ yes | Admins and highly regulated users. Entra checks the key make and model at registration. | Synced passkeys are excluded when attestation is enforced. |
| Device-bound profile with an AAGUID allow list | ✓ yes | Allow only the key models you issue. | Removing an allowed AAGUID stops keys of that model from signing in. |
| Device-bound and synced profile | ✓ yes | Most other users, as in Microsoft's HR and sales example. | Without attestation, Entra can't guarantee whether a passkey is synced or device-bound. |
| Admin-provisioned security key (Microsoft Graph, preview) | ✓ yes | Hand users a key that is ready to use. | Preview. Your own client inserts the key, sets a PIN and registers the credential for the user. |
What to do
- Passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Free. Sign in as at least an Authentication Policy Administrator and go to Entra ID > Security > Authentication methods > Policies > Passkey (FIDO2). Select the banner link to opt in to passkey profiles; you can't opt out afterwards.
- On the Configure tab, set Allow self-service set up to Yes. If it is No, users can't register a passkey in Security info.
- Select + Add passkey profile. Set Passkey types to Device-bound, choose whether to Enforce attestation, and if needed turn on Target specific AAGUIDs with Behavior set to Allow or Block.
- On Enable and Target, select Add target, pick the security key group, and assign the profile.
- Users open Security info, sign in with MFA, choose Add sign-in method > Passkey, and save the passkey to their security key.
- To require keys for sensitive apps, create a custom authentication strength under Entra ID > Authentication methods > Authentication strengths with Passkeys (FIDO2), optionally limited to specific AAGUIDs, and use it in Conditional Access.
Watch out
- Up to three passkey profiles are supported, including the Default passkey profile, and the Passkey (FIDO2) policy has a 20 KB size limit.
- Attestation is checked only at registration. Keys registered without attestation keep working if you turn it on later.
- A user in an excluded group is blocked from passkey registration and sign-in, even if they are also in an included group.
- If a user's UPN changes, they must delete their old passkey in Security info and add a new one.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID
- Microsoft Learn: Passkeys (FIDO2) authentication method in Microsoft Entra ID
- Microsoft Learn: Register a passkey with a FIDO2 security key
- Microsoft Learn: FIDO2 Security Key Sign-in to Windows
- Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Other situations
- Users without a smartphone
- Shared and kiosk Windows PCs
- Frontline workers and shared mobile devices
- B2B guests and internal guest users
- Windows Hello for Business and Entra passkey on Windows
- Passkeys in Microsoft Authenticator
- Break-glass accounts and Global Administrators
- Self-service password reset (SSPR)