cyber.hendryadrian.com
Security News · bleepingcomputer.com

Microsoft to Bring Entra Passkeys to Windows in Late April

· Original article ↗

Summary

Microsoft plans to begin rolling out Entra passkeys on Windows in late April, with general availability expected by mid-June 2026. The device-bound FIDO2 credentials will use Windows Hello and support unmanaged devices.

Key points

  • The rollout is expected to start in late April, with general availability by mid-June 2026.
  • Users can create device-bound FIDO2 passkeys stored in the local Windows Hello container and authenticate with face recognition, a fingerprint, or a PIN.
  • The feature supports corporate, personal, shared, and unmanaged Windows devices without requiring Entra join or registration.
  • Organizations can manage access through Microsoft Entra Authentication Methods and Conditional Access policies.
  • Microsoft says passkeys are cryptographically bound to each device and are not transmitted over the network.
  • The article links the feature to a security gap on personal and shared devices and notes recent Entra SSO credential-theft attacks; it does not report that the new feature has been independently tested against those attacks.

Article Details

Event Type
Microsoft announcement of a Windows passkey authentication feature rollout.
Impact
The feature is intended to extend phishing-resistant, passwordless Microsoft Entra ID sign-ins to unmanaged, corporate, personal, and shared Windows devices. Device-bound FIDO2 passkeys are stored locally in the Windows Hello container and, according to Microsoft, are not transmitted over the network, reducing the risk of passkey theft during phishing or malware attacks. The article says this addresses a security gap on personal and shared devices that had relied on password-based authentication.

Vendors

MicrosoftMicrosoft will roll out Entra passkey support on Windows starting late April, with general availability expected by mid‑June 2026, extending phishing‑resistant passwordless sign‑ins to unmanaged, corporate,

Products

Microsoft Entra IDThe new security feature will be available in organizations that have enabled ‘Microsoft Entra ID with passkeys’ in the ‘Authentication Methods policy’ for users who sign in to Windows devices that are not MicrosoftWindows HelloDevice‑bound FIDO2 passkeys will be stored in the Windows Hello container and managed via Conditional Access and Authentication Methods policies, closing a security gap exploited in recent Entra SSO credential‑theft

Related Articles