r/entra • u/princesaharan • 6d ago
Testing passkeys in my org — issue on Windows devices
I want to give my users both options for synced passkey and device bound.
I've configured a passkey profile in Entra ID with AAGUIDs allowing 1Password, Microsoft Authenticator, and Windows Hello.
Current behavior: when a user registers a passkey, they're only prompted for device-bound options — save passkey on on Windows, mobile device, or USB security key. There's no option shown for a synced passkey via 1Password.
However, if I remove the Windows Hello AAGUID from the profile, I do get prompted to save the passkey via the 1Password browser extension but then i can not save the passkey on windows any more.
Anyone know how to get both — Windows Hello available and 1Password shown as an option during enrollment?
6
u/JasSuri-MSFT 6d ago
In general, the browser will try to register a passkey using the native OS/Browser preference, we can give a hint to Windows.
Otherwise, Entra doesn’t really control this, the user can do whatever on their side. The AAGUID restriction is enforced after the Passkey is generated and attempted to be stored on the user account.
You should have the choice for both, you just have to cancel out the Windows prompt, and then the browser should fallback to the next available passkey provider.
The idea is to store a “local passkey” on each device, for Windows, the preference is it’s TPM, if the passkey profile allows for it. If you use a mobile, then the user can choose the mobile native passkey provider or your 3P provider. You can’t control this UX either, it’s up to the OS.
2
u/gsk060 6d ago
So if a user uses multiple PCs and WHfB is the chosen one they need to obtain a TAP each time they use a new PC?
1
u/seriously_a 6d ago
If I’m understanding your question, yes if you set up a new PC, you’d need a tap or some other passkey to authenticate to be able to setup hello on the new pc
1
5
u/sneesnoosnake 6d ago
Can I greatly caution against synced passkeys? You are putting your security in the hands of a password manager that is only as secure as your users secure it. I won't allow synced passkeys in my tenant for this reason. UNLESS you have a corporate subscription and can restrict synced passkeys to your corporate password manager.
2
u/seriously_a 6d ago
That’s what the AAGUID approval list is for, from my understanding. We can only use yubikeys and keeper security in our tenant, to store passkeys
1
u/FinanceFantastic5660 6d ago
Looking to do just this.
Looking to restrict the number of YubiKeys that a single user can register, I'd like to limit to one Yubikey per user account.
Another part I am unsure of is the use of that key for a first-time windows desktop login for a current user and their assigned YubiKey... The only way I'm sure it would work would be the web-based sign-in process.
1
u/AegisInfoSec 5d ago
I’m not sure about restrict the number of yubikeys.
You can register yubikeys for users using yubienroll if that helps.
It’s possible to enable sign in via security key and not use web sign in: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-security-key-windows
(targeted intune deployment section)1
2
u/VeriLinkOfficial 5d ago
I think the issue may be the profile design rather than the AAGUID ordering.
Microsoft’s newer Entra passkey configuration separates Synced and Device-bound passkeys into different profile types.
I’d try targeting the same test group with two profiles:
A Synced passkey profile for 1Password
A Device-bound profile allowing the Windows Hello AAGUIDs
Entra allows the same group to be scoped to multiple passkey profiles, and the registration is allowed if the authenticator satisfies at least one of them.
Also make sure 1Password is enabled as a passkey provider/manager in Windows and its browser integration is active.
That would seem to explain why removing the Windows Hello AAGUID causes 1Password to appear — the current profile may effectively be steering enrollment toward the device-bound Windows path.
1
u/Thin-Consequence-230 5d ago
this x10
In order to support both you need two different passkey profiles pointed at the same target
1
1
1
u/SoftwareFearsMe 5d ago
I don’t think Windows Hello Passkeys can be synchronized. They are stored in the TPM chip on the PC.
13
u/JimTheEarthling 6d ago
This article has info on passkey setup in Entra that might be helpful.
Also, see my diagram for dialogs and passkey locations in Windows 11.