Passkey Helper
Policy setup

Recommended Entra ID configuration

Diagram showing the Passkey Helper flow from tenant connection to user enforcement and reporting.
The rollout path: set up Entra groups, guide users, enforce passkeys, then track adoption.
Your Entra ID design remains your organisation's responsibility. These are concise recommendations for a secure, usable passkey rollout.

Start with authentication policies and platform SSO, then use Conditional Access to enforce the experience. A customised checklist populated with your group IDs is available in the Admin portal.

Authentication policies

In the Entra admin center, configure FIDO2 passkeys for all users, use the default profile for Microsoft Authenticator, and restrict registrations to the providers you intend to support.

  1. Open Authentication methods → Policies.
    Live Microsoft Entra Authentication methods Policies screen showing Passkey (FIDO2) enabled for all users.
    Authentication methods → Policies. Click to zoom.
  2. Open Passkey (FIDO2) and enable it.
    Live Microsoft Entra Passkey (FIDO2) Enable and target screen showing the method enabled for All users.
    Enable and target. Click to zoom.
  3. Set the target to All users, then select Configure.
  4. Open Default passkey profile.
    Live Microsoft Entra Passkey (FIDO2) Configure screen showing the default passkey profile and Key restrictions column.
    Configure. Click to zoom.
Pause before changing the profile: disabling a passkey type that users have already registered can make those passkeys stop working immediately. If all types are enabled, review User registration details and download the registered methods. Ask users to move to Authenticator first if needed.
  1. Enable Enforce attestation.
  2. Set Passkey types to Device-bound.
  3. Enable Target specific AAGUIDs.
  4. Set Behavior to Allow, then add the permitted provider AAGUIDs. For an Authenticator-based rollout, add Microsoft Authenticator for Android and Microsoft Authenticator for iOS.
    Live Microsoft Entra Edit passkey profile drawer showing attestation, device-bound passkeys, and allowed Microsoft Authenticator AAGUIDs.
    Default passkey profile and key restrictions. Click to zoom.
Key restrictions: only providers with an allowed AAGUID can register or use a passkey for this profile. Add the AAGUIDs for any other provider your organisation deliberately supports, such as approved security keys, before saving.

Employees are usually familiar with Authenticator push MFA and installing the app. Synced passkeys offer broader device support, but users may accidentally save and later lose the passkey in a personal password manager.

Platform credential

Passkey Helper expects users to have a platform credential on their account: either Windows Hello for Business (WHfB) or macOS Platform SSO. If this requirement is an issue for your organisation, contact support and we can remove this check.

We recommend deploying Windows Hello for Business (which is different from Windows Hello) and macOS Platform SSO, and doing this BEFORE inviting users to migrate through Passkey Helper. This is because setting up platform credentials often requires IT support to deploy MDM configuration. If a user does not have WHfB, the tool will offer some fault-finding tips, but it is best to have it ready before inviting users to migrate.

Conditional Access policies

Use three policies to enforce passkeys safely across desktop and mobile operating systems.

Policy 1: Passkey validation app

Protect the helper validation app so users must complete a phishing-resistant passkey check every time.

  • Users include: All users
  • Target resources: Passkey Migration Helper - Always Require Passkey app (46eadcca-e1c2-45a6-b44e-a193c201d78b)
  • Grant: Require Authentication strength → Phishing-resistant MFA
  • Session: Sign-in frequency = Every time

Policy 2: Desktop operating systems

Enforce passkeys for Windows, macOS, and Linux users in your enforcement group.

  • Users include: Enforcement group ID from your helper configuration
  • Users exclude: Break-glass accounts; optionally exclude your users-with-issues group during rollout
  • Target resources: Include all cloud apps
    • Optional exclude (passkey interrupt wizard):Windows Azure Active Directory (00000002-0000-0000-c000-000000000000), Azure Credential Configuration Endpoint Service (ea890292-c8c8-4433-b5ea-b09d0668e1a6)
  • Conditions → Device platforms: Include any device; exclude iOS and Android
  • Grant: Require Authentication strength → Phishing-resistant MFA

Policy 3: Mobile operating systems

Cover mobile sign-ins with the same enforcement group and a mobile-only policy.

  • Users include: Enforcement group ID from your helper configuration
  • Users exclude: Break-glass accounts; optionally exclude your users-with-issues group and incompatible devices group during rollout
  • Target resources: Include all cloud apps
    • Optional exclude (passkey interrupt wizard):Windows Azure Active Directory (00000002-0000-0000-c000-000000000000), Azure Credential Configuration Endpoint Service (ea890292-c8c8-4433-b5ea-b09d0668e1a6)
    • Optional exclude (iOS out-of-box enrollment):Microsoft Intune (0000000a-0000-0000-c000-000000000000), Microsoft Intune enrollment (d4ebce55-015a-49b5-a083-c84d1797ae8c)
  • Conditions → Device platforms: Include any device; exclude Windows, macOS, and Linux
  • Grant: Require Authentication strength → Phishing-resistant MFA
Questions? Reach us at passkey@a2g-cyber.com.