Microsoft is expanding its passkey infrastructure across both enterprise and consumer account systems. The company said its latest updates are intended to reduce dependence on passwords while giving organizations more control over how phishing-resistant authentication is deployed.
For enterprise customers, Microsoft said Entra ID now supports a stronger set of controls around passkey deployment, including administrator-defined attestation policies and broader support for hardware security keys. The work is aimed at organizations that need to enforce which authenticators can be used in regulated or high-risk environments, rather than treating all passkeys as equivalent.
The company also pointed to improvements in account recovery for Microsoft accounts, where passkeys can be used alongside other recovery options. Recovery remains one of the harder problems in passwordless authentication: if a user loses a device or changes phones, organizations need a way to restore access without reintroducing weak password reset flows.
The update lands as passkeys are moving from early adoption into operational scaling. A recent benchmark report on passkey adoption found that user experience, recovery, and cross-platform consistency remain major deployment issues even as the technology gains support from large platform vendors. Microsoft’s Entra work is part of the enterprise side of that transition, where passwordless login has to fit into compliance, procurement, and lifecycle management processes.
Microsoft said passkeys for Microsoft accounts already support users across Windows, Xbox, Microsoft 365, and other consumer services, giving the company a broad base for further deployment. That scale matters because enterprise adoption often depends on habits formed in consumer environments, where users become familiar with device-bound sign-in flows before encountering them at work.
The update also gives security teams a clearer bridge between platform passkeys and managed identity policy. In practice, organizations need to decide which authenticators are acceptable, how recovery is handled, and how exceptions are documented for users who cannot rely on a primary device.
The company’s positioning also reflects a broader shift in workforce authentication, where vendors are combining phishing-resistant credentials with identity governance, device posture, and biometric assurance. That trend has also appeared in recent passwordless biometric authentication deployments for clinical and enterprise workforces.
Sources: Microsoft, FIDO Alliance
–
By the ID Tech Editorial Team
