A passwordless sign-in credential based on FIDO that resists phishing. The private half of the key pair never leaves the person's device or hardware key, while the website or app stores just the public half; a passkey may be synced across devices or tied to a single one.
Also called FIDO2.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Passkey in context, with comparison tables and the common traps.
Terms in this definition
- Index field attributes
Settings applied to each field in an Azure AI Search index:
searchablefor full text,retrievableto return it,filterablefor exact-match$filter,sortable,facetablefor counts, andkeyfor the unique document ID. - App protection policy
A set of Intune rules on managed apps that safeguards organisational data, for example by demanding a PIN or preventing copy-paste and save-as into personal apps. It works whether or not the device is enrolled.
Related terms
- AAGUID
Passkey profiles and authentication strengths can permit or refuse particular authenticators by this value. It is a 128-bit ID handed over by the passkey (FIDO2) maker when a key is registered, telling Microsoft Entra which make and model it is.
- Agent's user account
Optional Microsoft Entra user object tied one-to-one to an agent identity, for services such as a mailbox, Teams or OneDrive that expect a user. No password or passkey exists for it, and privileged admin roles cannot be assigned to it.
- Device-bound passkey
A passkey tied to one physical device, such as a FIDO2 security key or Microsoft Authenticator, which generates its private key and never lets it leave. Synced passkeys work differently, with a passkey provider copying them from device to device.
- Passkey profile
A named group of passkey (FIDO2) settings applied to chosen groups, covering attestation, whether device-bound or synced passkeys are permitted, and AAGUID restrictions. Opting in is permanent and transfers your current settings into the Default passkey profile.
- Registration campaign
Nudges people who have just completed an interactive MFA sign-in to add a passkey or Microsoft Authenticator push notifications. You pick a single method per campaign and decide how many times users may postpone.
- Synced passkey
A passkey whose private key a provider such as Google Password Manager or Apple iCloud Keychain encrypts and copies between a person's devices. Device-bound passkeys support attestation, but synced ones don't.