I'm moving a Microsoft 365 tenant to passkeys and want to understand how this will work on Windows 11 Pro devices that are Microsoft Entra joined and already use Windows Hello for Business (WHfB) for sign-in.
In Entra's Authentication methods > Policies > passkey settings, selecting the Windows Hello AAGUID shows that it does not affect WHfB credentials. However, enabling it also warns that only device-bound passkeys will be allowed, meaning they cannot be used for cross-device authentication, and recommends allowing additional passkey options to reduce the risk of users being locked out.
My users have both PCs and phones. Do I need to add the Windows Hello AAGUIDs, and what passkey settings would provide a secure setup with a practical recovery option?
1 Answer
The two settings concern different credentials. The AAGUID policy controls passkeys registered through Windows Hello; it does not change or disable existing Windows Hello for Business credentials, which is what the information box is explaining.
If you want users to register Windows Hello-backed passkeys, add the relevant Windows Hello AAGUIDs to the passkey profile. Attestation enforcement must be disabled for this registration to work.
The important limitation is that these passkeys are device-bound. They won’t automatically work from a user’s phone or another PC, so a lost or damaged computer could leave someone without a usable passkey. Since your users have phones, a sensible configuration is to allow Windows Hello passkeys for their PCs and Microsoft Authenticator passkeys on their phones as an additional recovery or cross-device option.
Would allowing a phone-based passkey weaken the security of the whole setup? If a user loses a PC or phone, couldn’t an administrator simply have them register a new passkey on replacement equipment instead? I’m willing to handle re-registration if that provides stronger security, since one goal of passkeys is to avoid relying on push authentication.