This in-depth guide explains how to deploy FIDO2 passkeys in Microsoft Entra ID and Okta, including environment readiness, configuration steps, user migration, and phishing resistance best practices. Security leaders and identity architects will find practical recommendations that improve authentication strength while streamlining sign-ins across devices and platforms.
What Are FIDO2 Passkeys and Why They Matter for Modern Identity
FIDO2 passkeys use public-key cryptography to authenticate users without passwords or shared secrets. They bind authentication to the legitimate site origin and the user’s device, delivering strong phishing resistance and a faster sign-in experience.
Passkeys can be implemented by platform authenticators built into devices or by roaming security keys. Both approaches support cryptographic challenges that never expose a reusable credential.
- Platform passkeys: Built into devices such as laptops and phones. They can be device-bound or synced by the platform vendor across the user’s ecosystem, subject to enterprise policy.
- Roaming security keys: External FIDO2 hardware keys that connect via USB, NFC, or BLE. They are portable and often preferred for regulated environments.
- Attestation and AAGUID: Administrators can optionally require attestation and filter allowed authenticators by AAGUID to control which devices register in the tenant.
Prerequisites and Readiness Checklist for Microsoft Entra ID and Okta
Before enabling FIDO2 passkeys in Microsoft Entra ID and Okta, validate prerequisites. Proper planning reduces friction and improves enrollment success rates.
- Supported browsers and OS: Ensure modern browsers and operating systems with WebAuthn support are standard in your fleet.
- Device management alignment: Confirm management tools and compliance checks can detect device posture for conditional access or sign-on policy decisions.
- Identity hygiene: Clean up stale accounts, enforce strong recovery procedures, and define break-glass users with excluded policies.
- Communications and training: Prepare clear user guides for enrollment, recovery, and device replacement. Include accessibility considerations.
- Lifecycle and recovery: Define how users register multiple passkeys, handle lost devices, and rotate or revoke credentials promptly.
- Logging and monitoring: Confirm that audit logs capture authenticator type, registration, and sign-in outcomes for compliance reporting.
Microsoft Entra ID FIDO2 and Passkeys: Configuration Steps
Microsoft Entra ID supports both FIDO2 security keys and passkeys using platform authenticators. Exact options and naming can vary by tenant configuration and licensing, so validate features available in your environment before rollout.
Enable and Configure FIDO2 Security Keys in Entra ID
Start by enabling FIDO2 security keys as an authentication method and scoping it to pilot groups. This allows quick validation without impacting all users at once.
- Open the Entra admin center and locate Authentication methods management.
- Enable the FIDO2 security key method and target a pilot group or dynamic group.
- Optionally require key attestation and configure key restrictions by allowing or blocking AAGUIDs to control device models.
- Decide whether to permit self-service registration and whether a strong registration method is required first.
- Communicate registration steps to users and provide a supported list of FIDO2 keys or platforms.
Enable Passkeys with Platform Authenticators in Entra ID
When platform passkeys are available in your tenant, enable them for targeted groups. Confirm your device platforms and browsers meet enterprise requirements.
- Enable passkeys using the relevant authentication method settings in Entra ID.
- Scope to a pilot group and validate on managed Windows, macOS, iOS, and Android devices as applicable.
- Define whether device-bound or synced passkeys are permitted based on your risk model and compliance needs.
- If restricting, document the permitted authenticator families and communicate device coverage to users.
Use Conditional Access to Enforce Phishing-Resistant Sign-In
Conditional Access rules can elevate or require phishing-resistant factors for sensitive apps. Apply least privilege and test before broad enforcement.
- Create policies that require FIDO2 or passkeys for high-risk users, privileged roles, or sensitive applications.
- Leverage device compliance, sign-in risk, or location conditions to raise assurance when risk increases.
- Review sign-in logs to confirm that authenticator types meet expectations for phishing resistance.
Bootstrap Registration with Temporary Access Pass and SSPR
Reduce helpdesk load by enabling safe bootstrap flows that avoid insecure fallbacks. Temporary Access Pass and self-service password reset can assist first-time registration.
- Issue Temporary Access Pass to verified users for initial device setup or when recovering from a lost device.
- Require users to register at least two phishing-resistant methods where feasible, such as a platform passkey and a roaming FIDO2 key.
- Document device replacement and revocation steps to minimize downtime and risk.
Okta FIDO2 Passkeys: Configuration and Policy Design
Okta supports FIDO2 WebAuthn authenticators and passkeys, with policy controls for enrollment and sign-on. Align setup with your app catalog and workforce requirements.
Enable the WebAuthn Authenticator and Passkeys in Okta
Begin with a pilot. Confirm browser and platform support, then enable the authenticator and configure its enrollment rules.
- In the Okta admin console, add or enable the WebAuthn authenticator for workforce users.
- Allow platform and, if permitted, roaming authenticators to support both passkeys and hardware keys.
- If your policy requires attestation or specific device families, configure constraints that align with your inventory.
- Publish user-friendly enrollment steps with screenshots and clear requirements.
Enrollment and Sign-On Policies for Phishing Resistance
Design policies that encourage adoption while maintaining business continuity. Avoid sudden hard cutovers without a pilot and staged rollout.
- Create Authenticator Enrollment policies to require FIDO2 for target groups and critical apps.
- Configure Sign-On Policies to prefer or require phishing-resistant methods based on context and risk signals.
- Order authenticators so that Okta prompts for passkeys first, minimizing reliance on less secure factors.
- Exclude break-glass admins and monitor their usage separately.
Device Management and Okta FastPass Considerations
Okta also offers device-based phishing-resistant sign-in options for managed devices. Align these with passkeys where it simplifies user experience.
- Where device trust is required, combine phishing-resistant authenticators with device posture checks.
- Document when to use passkeys versus other strong, phishing-resistant authenticators to reduce confusion.
- Ensure incident response can revoke device credentials quickly and verify that revocation is reflected in logs.
User Migration Strategy: From Passwords and OTPs to FIDO2 Passkeys
Successful migration depends on communication, phased enforcement, and reliable recovery. Aim for a predictable, low-friction user journey.
Plan, Pilot, and Expand Adoption
Start with a representative pilot group that covers key operating systems, devices, and job functions. Gather feedback and iterate on guidance.
- Inventory current factors and identify apps that support modern authentication flows.
- Launch a pilot with clear success criteria and a rollback plan. Monitor enrollment and sign-in success.
- Expand by department or region, providing live support during the first weeks of adoption.
Communications, Training, and Change Management
Clear messaging reduces confusion and makes security feel like an upgrade, not a burden. Keep instructions simple and visual.
- Explain what passkeys are, why they are safer, and how they improve daily sign-ins.
- Provide short step-by-step guides for registering the first and second passkey on primary devices.
- Offer guidance for accessible sign-in options and accommodations where needed.
Recovery, Backup, and Break-Glass Controls
No rollout is complete without strong recovery. Build redundancy without reintroducing weak factors as permanent options.
- Require at least two strong authenticators where possible, such as a platform passkey plus a roaming key stored securely.
- Use Temporary Access Pass or time-bound recovery codes only for break-glass, with strict approval and auditing.
- Create a documented offboarding and device return process that revokes passkeys promptly.
Phishing Resistance Best Practices for Entra ID and Okta
Passkeys are only as strong as the surrounding policies. Close common downgrade paths and continuously monitor for gaps.
- Disable weak fallbacks: Phase out SMS, voice, and email OTP for high-value users and apps.
- Enforce origin binding: Train users to expect platform prompts tied to your real domain and avoid remote approval requests.
- Harden SSO paths: Prefer SP-initiated SSO with modern protocols. Minimize legacy protocols that bypass strong factors.
- Secure RADIUS and VPN: Where federation is used, ensure downstream systems honor phishing-resistant assurance levels.
- Monitor sign-in assurance: Alert when sign-ins use non-phishing-resistant factors for scoped users or applications.
- Protect admins: Require passkeys for privileged roles and enforce device compliance and Just-In-Time access.
Compliance, Auditing, and Assurance Levels
Map passkeys to assurance frameworks relevant to your industry. Maintain evidence of control design and effectiveness for audits.
- Use identity provider logs to demonstrate successful phishing-resistant authentications.
- Tag applications by required assurance level and enforce conditional policies accordingly.
- Retain enrollment and revocation records for device-bound and roaming authenticators.
- Document exceptions and compensating controls for legacy applications during transition.
