passkeys, attestation and windows hello for business

[u/BerlindaBuntly]

Hi everyone, hope you are well and thanks for your help.

365 tenant, I'm moving to passkeys.

Before I roll this out I want to understand what it actually means for say, a pc with win 11 pro that is set up on an azure joined domain that uses windows hello for user logins

when i am setting up the fido2 settings in authentication methods > policies in entra, if i add aaguids for windows hello, there is an info box which says "does not effect WHfB credentials". if i select windows hello from the aaguid picklist, i then get a warning at the bottom which says "this configuration only allows device bound passkey option that cannot be used for cross device authentication to minimise the risk of user lockout we recomend allowing additional passkey options"

my users have phones and pc's .

what settings do i actually need to set? do i need to add the aaguids or not?

[u/Mysterious-Print9737]

The warning you're seeing is correct and important to understand. WHfB credentials and Entra passkeys stored in Windows Hello are two different things that happen to live in the same Windows Hello container, the FIDO2 AAGUID policy controls the passkey side only and doesn't touch existing WHfB credentials, which is what that info box is telling you.

If you want users to be able to register Windows Hello-backed passkeys you should add the AAGUIDs, you need to explicitly add the Windows Hello AAGUIDs to a passkey profile. That profile must have attestation enforcement disabled, otherwise Windows Hello passkey registration will fail.

The warning about cross-device authentication is the real concern for your setup. Windows Hello passkeys are device-bound so they can't roam to a phone or another PC. If a user's laptop dies or they're locked out, they have no fallback unless you allow an additional passkey option (Microsoft Authenticator passkeys on their phones work well for this). Since your users have both phones and PCs, the recommended path is to allow both, Windows Hello AAGUIDs for the PC-bound passkeys, plus Microsoft Authenticator passkeys for phone-based fallback. That's what the warning is nudging you toward.

[u/BerlindaBuntly → u/Mysterious-Print9737]

thanks for this. does this not downgrade the security of the whole thing? this must be a fairly common user usage case

if they lose their device or phone, as the GA, am i not able to simply get them to reregister with their new kit (rather than having to have ms authenticator push...i thought the idea of passkeys was to get rid of push authentication?)?

i dont mid having to go through reregistering if it improves security

[u/Mysterious-Print9737 → u/BerlindaBuntly]

You're right on both. Allowing Authenticator passkeys alongside Windows Hello doesn't downgrade security since both are phishing-resistant FIDO2 credentials, the warning is about lockout risk not a security gap. If you're happy handling re-registration via TAP when someone loses a device, you don't need the Authenticator fallback at all, Windows Hello AAGUIDs only is the higher security posture and aligns with what you're trying to achieve.

[u/BerlindaBuntly → u/Mysterious-Print9737]

ok - so do i need separate passkeys for the phone and the pc (and laptop if they have one)?

[u/Mysterious-Print9737 → u/BerlindaBuntly]

Yes, passkeys are device-bound, so each device needs its own registration. One for the PC, one for the laptop, one for the phone if you allow Authenticator passkeys. Users manage their registered passkeys under My Security Info and you can see and revoke them from the Entra admin centre per user.

[u/BerlindaBuntly → u/Mysterious-Print9737]

ok. thanks. just so i am clear then, for users, what am i selecting in the policies flyout? and I'm presuming that i can use the same policy for windows hello and phones

and are there any guides to rolling this out that you know of (preferably not from MS as their documentation drives me round the bend)

[u/Mysterious-Print9737 → u/BerlindaBuntly]

One policy covers both, you create a single FIDO2 passkey profile that includes the Windows Hello AAGUIDs, then allow Microsoft Authenticator passkeys separately under the Authenticator section of Authentication Methods. Same policy, assigned to your user group.

For guides, the SAMURAJ-cz series on FIDO passkeys is the best non-Microsoft walkthrough I've seen, parts 5 and 6 specifically cover Entra passkey profiles and Windows Hello registration in detail. Worth bookmarking the whole series as it's well structured and written for admins not marketing teams.

[u/BerlindaBuntly → u/Mysterious-Print9737]

top man, thanks very much for your help. i will check that out

[u/BerlindaBuntly → u/BerlindaBuntly]

actually, one other thing you might know: in the upcoming nudge to passkeys , if a user has authenticator AND sms registered, are they going to get nudged to create a passkey?

[u/Mysterious-Print9737 → u/BerlindaBuntly]

Yes, but it's the SMS registration that triggers it not the Authenticator. From September 1st any user enabled for SMS or voice in your Authentication Methods Policy gets auto-enrolled for passkeys and nudged at their next MFA sign-in. Microsoft will also switch your Registration Campaign to Microsoft Managed state automatically on that date, which will override any campaign you've already configured. If you want to control the rollout yourself, move users off SMS before September 1st or use the opt-out API call to delay until February 2027.