passkey enrollment for entra id: helpdesk guide

TL;DR

Entra ID supports passkeys, including FIDO2 security keys and device-bound passkeys, as phishing-resistant MFA. Enrollment is self-service once the Authentication methods policy allows passkeys for the user. Helpdesk work is mostly confirming the policy targets the user and walking them through the browser prompts.

The query

passkey enrollment for entra id: helpdesk guide

Use this when

• rolling out passkeys as the primary MFA method
• user asks how to set up a passkey for their work account
• verifying a passkey registration completed correctly

Not for

• Authenticator app or SMS code problems (different methods)
• users on browsers that do not support WebAuthn
• shared devices where a personal passkey makes no sense

Steps

1. Check the Authentication methods policy: Passkey (FIDO2) is enabled and the user is in a targeted group. Expected output: the user is in scope
2. The user signs in and opens the security info page, then chooses Add method and Passkey. Expected output: the add-method wizard opens
3. The browser prompts for the security key or device biometrics; the user follows the prompts. Expected output: the ceremony completes without errors
4. Confirm the new passkey appears in the user's methods list. Expected output: registration visible to the admin as well
5. Have the user sign out and sign back in using the passkey. Expected output: sign-in succeeds with the passkey

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sUq-hE86VkjKUtCP7IKR9Q