Passkeys and FIDO2 in Microsoft Entra ID

Passkeys and FIDO2 security keys are the only Entra ID authentication methods that are genuinely phishing-resistant. This skill covers a pragmatic rollout: pick the right passkey types for your population, bootstrap via Temporary Access Pass, enforce via Conditional Access authentication strength, then retire legacy methods.

When to use

Moving an Entra tenant from password+SMS/app-push toward passwordless, phishing-resistant authentication. Use for method selection, registration campaigns, CA enforcement, and legacy-method retirement planning.

Do not use this skill for generic CA policy authoring (conditional-access-mfa), full Windows Hello for Business desktop design (windows-hello), or Verified ID credential issuance (entra-verified-id).

Passkey types — pick per population