Microsoft Entra passkeys: choose synced or device-bound

Key insights

• Device-bound passkeys stay on a hardware key or device; synced passkeys can be backed up and made available across devices.
• Microsoft's deployment guidance recommends device-bound passkeys for privileged users and synced passkeys for standard users.
• Microsoft Authenticator provides a workforce-focused, software-based device-bound passkey option.
• Hardware-key deployments need plans for registration, lost keys, recovery, replacement, and deprovisioning.
• The source description says Microsoft began enabling users for passkeys and prompting registration on September 1, 2026.

Microsoft Entra passkeys give organizations a phishing-resistant sign-in option, but admins need to choose whether credentials should sync across devices or remain device-bound. The choice matters to identity teams securing privileged accounts as well as teams rolling out authentication to the wider workforce. Merill Fernando discusses the deployment decision with FIDO Alliance CTO Nishant Kaushik in a YouTube interview.

What's new

The central decision is not simply whether to replace passwords. It is which type of passkey fits each user group and how to manage that credential over its lifecycle. Passkeys use cryptographic authentication; the FIDO Alliance CTO emphasizes that the goal is phishing resistance, rather than passwordless sign-in for its own sake.

The deployment discussion distinguishes three workforce options. Synced passkeys live in a passkey provider or credential manager and can be available on more than one compatible device. Device-bound passkeys remain on a particular device or hardware security key instead of syncing. Between those is a software-based, device-bound passkey managed through a workforce credential manager such as Microsoft Authenticator.

Microsoft's deployment guidance points organizations toward device-bound passkeys for administrators and other highly privileged users, and synced passkeys for standard users. That lets a deployment balance tighter control over credential location with portability and recovery. It is a way to assign different authentication methods according to risk, not a requirement to choose one model for everyone.

Who it is for and what you need

This choice is relevant to Microsoft Entra administrators planning phishing-resistant authentication, especially teams reviewing how users will register, recover, replace, and eventually remove credentials. Privileged identities may need a stricter device boundary; a broad employee population may benefit from passkeys that can be recovered through a provider's sync process. The appropriate choice depends on the organization's risk and requirements.

The interview and Microsoft deployment documentation discuss passkeys for workforce authentication. The video description says Microsoft began enabling users for passkeys and prompting them to register on September 1, 2026, and gives February 1, 2027, as the date Microsoft-provided SMS and voice MFA retire, with July 1, 2027, for Global Administrators and external users. These dates make it timely for affected organizations to review their authentication plans; the supplied material does not establish that every tenant has the same rollout experience.

The material does not specify a required Microsoft 365 or Entra license, a minimum client version, or regional eligibility for the passkey choices. Check the linked Microsoft documentation for the configuration and deployment details relevant to your tenant. The transcript also does not lay out an exact admin-center menu path, so this article does not prescribe one.

How it works

All three options use a passkey, but differ in where the credential is held and how users can recover it. A synced passkey is managed by a provider, which may be a platform credential manager or a third-party password manager. Its portability and backup can make device replacement easier, but the organization must assess whether synchronization fits its security requirements.

A hardware security key holds a device-bound credential. It does not sync to a replacement key, so losing or damaging it means the user needs an account recovery path and a process to register a replacement. A workforce credential manager provides another device-bound model: the organization can manage a credential for workforce sign-in without treating the credential as a general-purpose store for every service the user accesses.

1. Assess user groups and the risk of the accounts they access. Identify privileged users and any policies that rule out synchronized credentials.
2. Choose a credential model for each group: synced passkeys for users where portability is appropriate, and device-bound credentials where tighter control is needed.
3. Plan enrollment and recovery before issuing credentials. For hardware keys, account for identity verification at registration, backups, lost-key replacement, and deprovisioning.
4. Pilot the process and review the passkey methods registered in your tenant. The video description specifically advises admins to check what Microsoft's rollout has enabled and prompted users to register.

These steps reflect the lifecycle concerns raised in the discussion: onboarding, use, monitoring, recovery, revocation, and deprovisioning. For Microsoft's configuration options, consult its documentation on passkey profiles, Authenticator passkeys, and phishing-resistant passwordless deployment.

Limitations and open questions

Synced and device-bound passkeys involve different trade-offs; neither eliminates the need for an account recovery plan. Sync can aid recovery and portability, while hardware-bound credentials provide a stronger boundary around where the credential exists. A lost hardware key can also create an access problem if the organization has not prepared backups or a replacement process.

The interview transcript ends while the speakers are discussing the operational details of device-bound keys, so it does not provide a complete purchasing or configuration walkthrough. It raises the need to consider certified hardware keys, identity verification at registration, backups, and replacement, but does not name specific models or provide a full procurement checklist. It also says that, at the time of the discussion, PQC-ready hardware keys were not really available in the market; no specific product or later availability is established here.

The material does not specify tenant-by-tenant rollout status or the exact steps to enable each passkey type. It also does not support treating SMS retirement as proof that passkeys are the only possible authentication method. Use the Microsoft guidance to confirm supported profiles and plan a deployment that matches your users and policies.

Sources

• Microsoft Entra SMS and voice MFA retirement and passkeys
• Configure passkeys (FIDO2) and passkey profiles in Microsoft Entra ID
• Enable passkeys in Microsoft Authenticator
• Plan a phishing-resistant passwordless deployment
• Merill Fernando's interview with FIDO Alliance CTO Nishant Kaushik

Frequently asked questions

Should Microsoft Entra admins use synced or device-bound passkeys?

Microsoft's deployment guidance recommends device-bound passkeys for administrators and highly privileged users. Synced passkeys are generally recommended for standard users, while organizational risk and policy should guide the choice.

What is the difference between a synced and device-bound passkey?

A synced passkey can be backed up and used across compatible devices through a passkey provider. A device-bound passkey stays on its device or hardware security key and does not sync to another one.

Does Microsoft Authenticator support device-bound passkeys?

The supplied material describes Microsoft Authenticator as a workforce credential manager that supports software-based, device-bound passkeys. It does not give the configuration steps or licensing requirements.

What should an organization plan for when issuing hardware security keys?

Plan for registration and identity verification, backups, lost-key recovery, replacement, and deprovisioning. The material does not name specific key models or provide a full purchasing guide.