Google has added support for FIDO2-compliant physical security keys at the Windows login screen through Google Credential Provider for Windows, extending phishing-resistant two-step verification to managed desktop sign-in.
The update also lets users approve their second factor with a passkey stored on a nearby Bluetooth-connected mobile device. Both methods can now be used when an organization relies on GCPW to let employees authenticate to Windows with their Google Workspace accounts.
Administrators control the policy through Google Workspace’s two-step verification settings. They can require security keys for selected organizational units or groups, while users do not receive a separate setting for the new GCPW capability. Google says the feature is available to all Workspace customers.
The change is rolling out gradually across both Rapid Release and Scheduled Release domains. Deployment began July 13 and may take up to 15 days before the option is visible in every eligible environment.
Physical security keys use public-key credentials rather than a reusable code. During authentication, the key proves possession of a private credential associated with the legitimate service, reducing exposure to phishing pages and intercepted one-time passwords. Mobile passkeys use the same general credential model while allowing the phone to act as the nearby authenticator.
The GCPW implementation remains a second-factor feature. Google describes it as an addition to the Windows login flow, not as a replacement for every credential involved in local sign-in. Organizations also need enrolled keys or passkeys and appropriate recovery procedures before enforcing a security-key-only policy.
Desktop authentication has become a more active part of enterprise passwordless strategy. RSA recently extended passwordless authentication to Linux environments, adding to earlier work on desktop logon, while hardware vendors are expanding higher-assurance products such as FIDO2 Level 2-certified NFC security keys.
Existing Workspace 2SV enforcement policies can now reach the Windows lock screen with standard FIDO2 hardware. The nearby-device option provides an alternative for employees who already keep a passkey on a phone, reducing the need to issue a separate key in every deployment while preserving an administrator-controlled authentication requirement. Administrators can therefore support two authenticator form factors under the same Workspace policy.
Sources: Google Workspace Updates, Google Workspace Help
–
By the ID Tech Editorial Team
