
Entra passkeys enable phishing-resistant sign-ins on Windows
Microsoft is rolling out Entra passkeys on Windows to enable phishing-resistant, passwordless sign-in via Windows Hello. The opt-in public preview runs mid-March to late April 2026 for worldwide tenants (government-cloud timelines differ) and extends passwordless sign-in to unmanaged Windows devices. Passkeys are device-bound and per-account (no cross-device syncing), with multiple accounts able to coexist on one machine; each Entra account must register its own passkey. Admins must enable Passkeys (FIDO2) in Entra, create a Windows Hello profile with required AAGUIDs, and assign it to groups.
