In Microsoft 365 Posted September 1st, 2026
Passwords remain a common target for phishing, credential theft, password reuse, and account takeover. As businesses move toward stronger identity security, Microsoft Entra ID passkeys are becoming an important option for passwordless and phishing-resistant authentication.
Passkeys in Entra ID help organizations strengthen user authentication while reducing their dependence on traditional passwords. At CODISM, we provide professional Microsoft Entra ID services to help businesses assess, implement, configure, and manage modern authentication solutions based on their security and business requirements.
Microsoft Entra ID passkeys are modern authentication credentials based on public-key cryptography rather than traditional passwords. Passkeys use FIDO2 and WebAuthn technologies to provide strong, phishing-resistant authentication.
Depending on the passkey type and device, users can authenticate using a PIN, fingerprint, facial recognition, security key, or another supported device-based authentication method.
With Microsoft Entra passkeys, organizations can establish stronger authentication for users accessing Microsoft 365, cloud applications, and other supported resources.
Passkeys can also support organizations working toward Zero Trust by providing a stronger method of verifying user identities.
Microsoft Entra ID currently supports two primary categories of passkeys: synced passkeys and device-bound passkeys.
Synced passkeys can be stored in supported passkey providers and synchronized across devices associated with that provider.
Examples include:
Synced passkeys can make passwordless authentication more convenient for users who work across multiple devices. Microsoft Entra ID allows organizations to enable synced passkeys through passkey profiles.
Device-bound passkeys are tied to a specific authenticator or device and are not synchronized between devices.
Microsoft Entra ID supports device-bound passkeys through options such as:
FIDO2 security keys are particularly useful for administrators, privileged users, and organizations with strict security or regulatory requirements because the private key remains on the physical security key.
Microsoft has also introduced Microsoft Entra passkey on Windows, which allows users to create device-bound FIDO2 passkeys directly in the local Windows Hello container.
Users can authenticate using Windows Hello methods such as:
The Windows device does not need to be Microsoft Entra joined or registered to use this local passkey capability.
Password-based authentication can create security challenges when credentials are reused, stolen, or exposed through phishing attacks. Businesses therefore need authentication methods that provide stronger protection without creating unnecessary complexity for users.
Microsoft Entra ID passkeys can help organizations:
Our approach is focused on helping businesses improve authentication security while maintaining productivity and business continuity.
Implementing passkeys requires appropriate configuration of authentication policies and user groups. Microsoft Entra ID now provides passkey profiles, which allow administrators to configure different passkey requirements for different groups of users.
A typical implementation process includes the following steps:
An administrator with the appropriate Authentication Policy Administrator role can access the Microsoft Entra admin center and navigate to:
Entra ID → Security → Authentication methods → Policies → Passkey (FIDO2)
Administrators can enable passkey profiles and configure the authentication settings for their organization.
Administrators can create or modify a passkey profile and define the authentication requirements.
The profile can specify:
This allows organizations to use different authentication configurations for administrators, employees, contractors, or other user groups.
Organizations can apply a passkey profile to selected groups or users rather than immediately applying the same configuration across the entire organization.
A phased rollout can help IT teams test authentication, identify compatibility issues, and prepare users before expanding deployment.
After the appropriate authentication policy is enabled, users can register a passkey through their Security info page.
The general registration process includes:
The available registration options depend on the user’s device, browser, operating system, and enabled passkey policies.
Organizations can use Conditional Access authentication strength policies to require passkeys for sensitive applications and resources.
For example, businesses can create authentication strength requirements that allow or require passkey-based authentication for administrators or users accessing sensitive corporate resources.
Microsoft has announced a significant change to authentication in Microsoft Entra ID.
Beginning September 1, 2026, Microsoft will begin rolling out passkeys as the default authentication experience for Microsoft Entra ID. Users enabled for SMS or voice authentication will be automatically enabled for passkeys and prompted to register a passkey when they perform multifactor authentication.
Microsoft also announced that its native SMS and voice authentication delivery will be retired on February 1, 2027. Organizations that still need SMS or voice authentication after that point will need to use supported telecom providers through the Microsoft Security Store.
This update represents an important shift toward phishing-resistant authentication.
Microsoft recommends that organizations begin preparing now by:
For organizations planning an Entra ID authentication modernization project, this change makes passkey readiness increasingly important.
Passkeys can support a Zero Trust security strategy by strengthening identity verification and reducing dependence on credentials that can be stolen or phished.
Unlike traditional passwords, passkeys use cryptographic credentials. During authentication, Microsoft Entra ID verifies a cryptographic response from the registered authenticator rather than relying on the user to provide a reusable password.
Organizations can combine passkeys with other Microsoft security capabilities, including Conditional Access, identity governance, device management, and Microsoft 365 security controls.
Successful passkey adoption requires more than simply enabling an authentication method. Organizations need appropriate planning, configuration, user preparation, security policies, testing, and ongoing management.
CODISM provides Microsoft identity and security expertise to help businesses modernize authentication and establish a more secure access environment.
Our Microsoft Entra ID services can support organizations with:
We help businesses choose authentication approaches that align with their security requirements, user environment, applications, and business objectives.
Microsoft Entra ID passkeys provide organizations with a modern way to strengthen authentication and reduce dependence on passwords. By adopting Microsoft Entra passkeys, businesses can improve passwordless access, strengthen phishing-resistant authentication, and support modern identity security strategies.
With Microsoft making passkeys the default authentication experience beginning September 2026, organizations should start preparing their Entra ID environments and users for this significant authentication change.
CODISM helps organizations plan, implement, optimize, and manage Microsoft Entra ID passwordless authentication, FIDO2 authentication, passkey solutions, and broader Microsoft identity security services.
Microsoft Entra passkeys are FIDO2-based authentication credentials that use public-key cryptography to provide passwordless and phishing-resistant authentication.
Microsoft Entra ID supports synced passkeys and device-bound passkeys. Device-bound options include FIDO2 security keys, Microsoft Authenticator passkeys, and Microsoft Entra passkeys on Windows.
Microsoft Entra ID passkeys can reduce password dependency, strengthen authentication security, improve protection against phishing, and provide a convenient passwordless sign-in experience.
Administrators can enable Passkey (FIDO2), configure passkey profiles, target appropriate users or groups, allow users to register their passkeys, and optionally use Conditional Access authentication strength to require passkeys for specific resources.
Microsoft Entra ID passwordless authentication allows users to authenticate without relying on traditional passwords. Supported approaches include passkeys, FIDO2 security keys, Microsoft Authenticator, and other Microsoft passwordless authentication technologies.
FIDO2 passkeys in Entra ID use public-key cryptography and FIDO standards to provide strong, phishing-resistant authentication for supported scenarios.
Microsoft announced that passkeys will become the default authentication experience in Microsoft Entra ID beginning September 1, 2026. Microsoft also plans to retire its native SMS and voice authentication delivery on February 1, 2027.
Yes. CODISM provides Microsoft Entra passkey assessment, implementation, authentication policy configuration, FIDO2 support, passwordless authentication planning, Conditional Access integration, and ongoing identity management.
Strengthen your organization’s identity security with professional Microsoft Entra ID passkeys and passwordless authentication services from CODISM.
Our experts help businesses modernize authentication, implement FIDO2 solutions, configure Microsoft Entra security policies, and prepare for the transition toward phishing-resistant authentication.
Contact us today
Email: info@codism.io Website: www.codism.io USA Office: 973-814-2525
Δ