I manage a Microsoft 365 tenant and am preparing to roll out passkeys. Our Windows 11 Pro PCs are Microsoft Entra joined and users already sign in with Windows Hello for Business.
In Entra under Authentication methods > Policies, the FIDO2 settings include AAGUID options for Windows Hello. The information box says that this setting does not affect Windows Hello for Business credentials. However, selecting the Windows Hello AAGUID displays a warning that the configuration only permits device-bound passkeys, which cannot be used for cross-device authentication, and recommends allowing additional passkey options to reduce the risk of user lockout.
Our users have both PCs and phones. Should I add the Windows Hello AAGUIDs? What passkey settings are recommended, and how should lost or replaced devices be handled without weakening the security model?
1 Answer
Windows Hello for Business credentials and passkeys registered through the FIDO2 policy are separate, even though both use the Windows Hello platform. Adding Windows Hello AAGUIDs for passkeys will not change or disable existing Windows Hello for Business sign-in credentials.
If you want users to register Windows Hello-backed passkeys, add the applicable Windows Hello AAGUIDs to the passkey profile. Make sure attestation enforcement is disabled for that profile, otherwise registration may fail.
The warning is about recovery and cross-device use. Windows Hello passkeys are device-bound, so they cannot automatically roam to a phone or another PC. For users who have both a computer and a phone, a practical configuration is to allow Windows Hello passkeys for device-bound use and also allow Microsoft Authenticator passkeys as a separate phone-based option. That gives users a fallback if their PC is lost or replaced.
Does allowing Authenticator passkeys reduce the security of the overall setup? If someone loses a PC or phone, could an administrator simply have them register again on the replacement device instead? I am comfortable handling re-registration if that avoids relying on push authentication, since one of the goals of passkeys is to move away from push prompts.