Passkey on Windows-hello container

Question

Passkey on Windows-hello container

testuser7 286

Seems like there is one more mess in passkeys. I do not know why Microsoft keeps changing the behavior.

Earlier user can store passkey-cred in the WH-container for the same account. So in my ******@abcd.com WH-container there will be of course WH-cred and also passkey-cred for ******@abcd.com

Now they do not allow to create passkey-cred (******@abcd.com) from mysignins.microsoft.com

The logical reason is to NOT confuse the users. Understandable.

But then they are breaking the CA-policy. Now the resource which is demanding only and only passkey-cred CAN NOT be satisfied by WH-cred

they should avoid this CA-policy failure by implementing same design that is on MacOS where the single secure-enclave cred is re-purposed to complete the FIDO auth ceremony response to fulfill passkey requirement.

0 comments

1 answer

Your answer

Answer 1

What is supported on Windows is this:

A Microsoft Entra passkey on Windows is a device-bound passkey stored in the local Windows Hello container.
Windows Hello for Business and Microsoft Entra passkey on Windows are treated as different credentials with different purposes and behavior.
On a Microsoft Entra joined or registered device, setting up Windows Hello can automatically register a Windows Hello for Business credential for the linked account.
If a passkey is then registered on Windows for that same account, registration can fail because the Windows Hello for Business credential already exists. On retry, the error indicates the passkey is already registered.

That means the current Windows behavior is not a repurposing model like the one described for other platforms. The documented behavior is that Windows Hello for Business and Microsoft Entra passkey on Windows are separate, and an existing Windows Hello for Business credential can block passkey registration for the same account on that device.

For the Conditional Access concern, the available documentation here only supports that these are separate credential types. It does not state that Windows Hello for Business will satisfy a policy that requires a passkey, and it does not document a Windows design that reuses the Windows Hello credential to complete the passkey ceremony for the same account.

Also note these prerequisites for Microsoft Entra passkey on Windows:

Passkey sign-in must be enabled in Authentication methods in the Passkey (FIDO2) policy.
The device must run a supported version of Windows and support Windows Hello.
For registration, the administrator must allow Windows Hello AAGUIDs in the passkey profile.
If the device already has the linked Windows Hello for Business credential for that same account, that can be the reason registration fails.

If the goal is to use a true passkey on Windows for that account, the supported path in the documentation is to configure Microsoft Entra passkey on Windows explicitly through the Entra authentication methods policy and passkey profile, rather than expecting Windows Hello for Business to be reused as the passkey.