Shared and kiosk Windows PCs: after Entra SMS and voice MFA retire
Short answer: Give each user of a shared Windows PC their own FIDO2 security key, a portable passkey they can use on any PC that has security key sign-in turned on. Microsoft's deployment guide says users who share devices should only use Microsoft Entra passkey on Windows or portable credentials. Windows Hello for Business supports up to 10 users per device and shouldn't be used on kiosks that use a shared account.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| FIDO2 security key | ✓ yes | Many users per PC, or users who move between PCs. Works for Windows sign-in on Microsoft Entra joined and hybrid joined devices. | Security key sign-in must be turned on for each PC. On-premises-only domain joined PCs aren't supported. |
| Microsoft Entra passkey on Windows | ✓ yes | Users who sign in to a shared PC as themselves. One PC can hold passkeys for several Entra accounts and doesn't need to be joined. | Doesn't sign in to Windows itself. Each PC needs its own registration for each account. |
| Windows Hello for Business | ✓ yes | A few named users, each signing in to the PC as themselves. | Up to 10 enrollments per device. Not for kiosks that use a shared user account. |
| Temporary Access Pass with Web sign-in | no | Onboarding or recovery on Microsoft Entra joined PCs, for example a lost key and an unknown password. | Web sign-in needs Windows 11 version 22H2 with KB5030310 or later and internet access. Not supported on hybrid joined or domain joined PCs. |
What to do
- Enable passkeys (FIDO2) and add a passkey profile with Passkey types set to Device-bound (Microsoft's example names it FIDO2 security keys). Target it at the shared-PC user group.
- In the Intune admin center, go to Devices > Enroll Devices > Windows enrollment > Windows Hello for Business and set Use security keys for sign-in to Enabled. This doesn't depend on Windows Hello for Business being configured.
- For devices that are already provisioned, create a custom profile with OMA-URI
./Device/Vendor/MSFT/PassportForWork/SecurityKey/UseSecurityKeyForSignin, data type Integer, value 1. For devices outside Intune, use a provisioning package withUseSecurityKeyForSignInset to Enabled. - For hybrid joined PCs, enable the Group Policy Turn on security key sign-in and complete the steps to enable FIDO2 authentication to on-premises resources.
- Have each user register their key in Security info, or provision keys for them with the Microsoft Graph APIs (preview).
- Optional: on Microsoft Entra joined PCs, turn on Enable Web Sign In so users can sign in with a TAP to onboard or recover a key.
Watch out
- For devices with more than 10 users, Microsoft recommends FIDO2 security keys instead of Windows Hello for Business.
- Security keys aren't supported in RDP or VDI sessions without WebAuthn redirection, with Run as, or for signing in to a server.
- On the latest Windows 11 versions, running certutil -deletehellocontainer also removes passkeys stored on that PC.
- If one key holds several Entra accounts, Windows sign-in defaults to the last account added to the key.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: FIDO2 Security Key Sign-in to Windows
- Microsoft Learn: Plan a phishing-resistant passwordless authentication deployment in Microsoft Entra ID
- Microsoft Learn: Windows Hello for Business Frequently Asked Questions (FAQ)
- Microsoft Learn: Enable Microsoft Entra passkey on Windows
- Microsoft Learn: Use Web Sign-In To Enable Passwordless Sign-In In Windows
- Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID
Did this fix it?
Other situations
- Users without a smartphone
- Frontline workers and shared mobile devices
- B2B guests and internal guest users
- FIDO2 security keys and passkey profiles
- Windows Hello for Business and Entra passkey on Windows
- Passkeys in Microsoft Authenticator
- Break-glass accounts and Global Administrators
- Self-service password reset (SSPR)