For a personal account using login.live.com adding a passkey is perfectly fine, but at entra.microsoft.com and myaccount.microsoft.com, I am able to go through all of the steps, but when it comes to naming the entry - it always fails (see below).
I have successfully added passkeys using a Yubico FIDO2 hardware key. I have been able to create and store passkeys in all my online accounts, except at Microsoft (O365/M365/Entra).
Lots of posts about passkeys not showing up - or not appear once added in various MS services… but nothing much about being unable to add a passkey, when other security keys work perfectly fine.
Tried a non-AD account which does not even have Hello configured - same problem. Moved on to a VM with Windows Hello disabled entirely - and still the problem persists. Doesn’t work on Android, iOS or MacOS either.
Microsoft being as big as it is, I’d bet you’d find the answer on how to set it up on one of their support forums. Might try that and see if you get help.
Went there too… the usual copy and paste net warriors with nothing else to suggest than to reset and reconfigure the entire 2FA setup (which was the first and most obvious thing when using MS AD ). And still no joy.
Interesting! Passkeys are still an evolving technology that has a ways to go before being fully standardized, so I will pass this information on to our team so we can keep an eye out.
@EionRobb, welcome to the community and thanks for the pointer.
This is the critical bit:
Microsoft Entra ID will add support for device-bound passkeys stored on computers and mobile devices as an authentication method in preview, in addition to the existing support for FIDO2 security keys.
Bitwarden, Apple, and most others allow syncable Passkeys; Microsoft seems dead-set on device-bound.
Same issue, I was able to inconsistently get the registration process started and save the key to Bitwarden but when entering a name for the key, I get the same error.
Also, the Passkey popup does not show up consistently and is intercepted by the USB handler on Chrome and Edge.
I’ve also started experimenting with this and have been unable to configure Bitwarden or iCloud/iOS to use passkeys. I get to the end of the process then receive the same error message alcyone7 posted. I did get Windows Authenticator configured to use passkeys as well as Yubikey (Yubikey is a “Microsoft-compatible security key vendor” listed here → https://learn.microsoft.com/en-us/entra/identity/authentication/concept-fido2-hardware-vendor#current-partners
The article EionRobb referenced talks about an upcoming naming convention change in Entra ID authentication methods portal (renaming “FIDO2 security keys” to “Passkeys (FIDO2)” but that name change has not happened in my portal yet, so I assume support for device-bound passkeys (i.e. mobile apps that are not Microsoft Authenticator) has not happened yet either.
Seems like they are on the cusp of enabling this but have not for some reason. I hear the big software vendors (Microsoft, Apple, Google, etc) are all trying to co-opt passkey technology and platform-lock users into their own respective products, my gut feeling is that is what’s happening here.
Or it is supported and I’m just not doing it right, that’s a possiblity too, ha.
Microsoft Entra ID will add support for device-bound passkeys stored on computers and mobile devices as an authentication method in preview, in addition to the existing support for FIDO2 security keys.
Bitwarden, Apple, and most others allow syncable Passkeys; Microsoft seems dead-set on device-bound
Interesting, I was about to create a thread of this exact issue with the error Additional details
). And still no joy.
