Native app and browser support of FIDO2 passwordless authentication - Microsoft Entra ID (2024)

Table of Contents
In this article Native app support (preview) Browser support Browser support for each platform Windows macOS ChromeOS Linux iOS Android Minimum browser version Known issues Mobile device might be prioritized over security key PowerShell support Next steps FAQs
  • Article

Microsoft Entra ID allows FIDO2 security keys to be used as a passwordless device. The availability of FIDO2 authentication for Microsoft accounts was announced in 2018, and it became generally available in March 2021. This topic covers which browsers, native apps, and operating systems support passwordless authentication using FIDO2 security keys with Microsoft Entra ID. Microsoft Entra ID currently supports only hardware FIDO2 keys and doesn't support passkeys for any platform.

Native app support (preview)

Microsoft applications provide native support for FIDO2 authentication in preview for all users who have an authentication broker installed for their operating system. The following tables lists which authentication brokers are supported for different operating systems.

Operating systemAuthentication brokerSupports FIDO2
iOSMicrosoft Authenticator✅
macOSMicrosoft Intune Company Portal 1✅
Android2Authenticator or Company Portal❌

1On macOS, the Microsoft Enterprise SSO plug-in is required to enable Company Portal as an authentication broker. Devices that run macOS must meet SSO plug-in requirements, including enrollment in mobile device management. For FIDO2 authentication, make sure that you run the latest version of native applications.

2Native app support for FIDO2 on Android is in development.

If a user installed an authentication broker, they can choose to sign in with a security key when they access an application such as Outlook. They're redirected to sign in with FIDO2, and redirected back to Outlook as a signed in user after successful authentication.

See Also
Works With YubiKey CatalogFido vs Koodo vs Virgin Plus: Which Carrier is Best for You?U.S State uses YubiKey to Protect VotersTOKEN2 Sàrl is a Swiss cybersecurity company specialized in the area of multifactor authentication. We are a FIDO Alliance member.

If the user hasn't installed an authentication broker, they can still sign in with a security key when they access MSAL-enabled applications that meet the requirements as listed in Support for FIDO2 authentication.

Note

FIDO2 authentication for Microsoft applications without an authentication broker isn’t available yet.

Browser support

This table shows browser support for authenticating Microsoft Entra ID and Microsoft accounts by using FIDO2. Microsoft accounts are created by consumers for services such as Xbox, Skype, or Outlook.com.

OSChromeEdgeFirefoxSafari
Windows✅✅✅N/A
macOS✅✅✅✅
ChromeOS✅N/AN/AN/A
Linux✅❌❌N/A
iOS✅✅✅✅
Android❌❌❌N/A

Browser support for each platform

The following tables show which transports are supported for each platform. Supported device types include USB, near-field communication (NFC), and bluetooth low energy (BLE).

Windows

BrowserUSBNFCBLE
Edge✅✅✅
Chrome✅✅✅
Firefox✅✅✅

macOS

BrowserUSBNFC1BLE1
Edge✅N/AN/A
Chrome✅N/AN/A
Firefox2✅N/AN/A
Safari2✅N/AN/A

1NFC and BLE security keys aren't supported on macOS by Apple.

See Also
Still Using Passwords? Get Started with Phishing-Resistant, Passwordless Authentication Now!

2New security key registration doesn't work on these macOS browsers because they don't prompt to set up biometrics or PIN.

ChromeOS

Browser1USBNFCBLE
Chrome✅❌❌

1Security key registration isn't supported on ChromeOS or Chrome browser.

Linux

BrowserUSBNFCBLE
Edge❌❌❌
Chrome✅❌❌
Firefox❌❌❌

iOS

Browser1LightningNFCBLE2
Edge✅✅N/A
Chrome✅✅N/A
Firefox✅✅N/A
Safari✅✅N/A

1New security key registration doesn't work on iOS browsers because they don't prompt to set up biometrics or PIN.

2BLE security keys aren't supported on iOS by Apple.

Android

Browser1USBNFCBLE
Edge❌❌❌
Chrome❌❌❌
Firefox❌❌❌

1Security key biometrics or PIN for user verification are currently supported on Android by Google. Microsoft Entra ID requires user verification for all FIDO2 authentications.

Minimum browser version

The following are the minimum browser version requirements.

BrowserMinimum version
Chrome76
EdgeWindows 10 version 19031
Firefox66

1All versions of the new Chromium-based Microsoft Edge support FIDO2. Support on Microsoft Edge legacy was added in 1903.

Known issues

Mobile device might be prioritized over security key

If you're using Chrome or Edge, the browser might prioritize usage of a passkey that's stored on a mobile device over a passkey that's stored on a security key.

  • Beginning with Windows 11 version 23H2, the operating system shows the following prompt during sign-in. Below More choices, choose Security key and click Next.

    Native app and browser support of FIDO2 passwordless authentication - Microsoft Entra ID (1)

  • On earlier versions of Windows, the browser may show the QR pairing screen to continue with using a passkey that's stored on a mobile device. To use a passkey that's stored on a security key instead, insert your security key and touch it to continue.

    Native app and browser support of FIDO2 passwordless authentication - Microsoft Entra ID (2)

PowerShell support

Microsoft Graph PowerShell supports FIDO2. Some PowerShell modules that use Internet Explorer instead of Edge aren't capable of performing FIDO2 authentication. For example, PowerShell modules for SharePoint Online or Teams, or any PowerShell scripts that require admin credentials, don't prompt for FIDO2.

As a workaround, most vendors can put certificates on the FIDO2 security keys. Certificate-based authentication (CBA) works in all browsers. If you can enable CBA for those admin accounts, you can require CBA instead of FIDO2 in the interim.

Next steps

Enable passwordless security key sign-in

Native app and browser support of FIDO2 passwordless authentication - Microsoft Entra ID (2024)

FAQs

Native app and browser support of FIDO2 passwordless authentication - Microsoft Entra ID? ›

Native application support

Read On ›
Which browsers support FIDO2? ›

As of November 2020, the representative browsers that support FIDO2 include Google Chrome, Mozilla Firefox, Microsoft Edge, and Safari. Internet Explorer does not support FIDO2. Note that FIDO2 may not be supported with the browsers mentioned above, depending on the combination with the OS environment you use.

Discover More Details ›
How do I enable FIDO2 in entra? ›

Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator. Browse to Protection > Authentication methods > Authentication method policy. Under the method FIDO2 security key, select All users or Add groups to select specific groups. Only security groups are supported.

Continue Reading ›
What is Microsoft Entra ID in the authenticator app? ›

Microsoft Entra multifactor authentication adds additional security over only using a password when a user signs in. The user can be prompted for additional forms of authentication, such as to respond to a push notification, enter a code from a software or hardware token, or respond to a text message or phone call.

See Details ›
Is the Microsoft Authenticator app FIDO2? ›

Microsoft Azure and Azure Government offer the following four passwordless authentication options that integrate with Microsoft Entra ID: Windows Hello for Business. Microsoft Authenticator. Passkeys (FIDO2)

Find Out More ›
Does Chrome support FIDO2? ›

Support for FIDO2: WebAuthn and CTAP

WebAuthn is currently supported in Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari web browsers, as well as Windows 10 and Android platforms.

Tell Me More ›
Does Firefox support FIDO2? ›

Mobile platforms

Firefox for Android (Fenix) supports the Google Play Services FIDO2 authenticator for WebAuthn, which provides support for many compliant devices as well as built-in platform authenticators such as fingerprint sensors.

Show Me More ›
Does YubiKey support FIDO2? ›

Multi-protocol security key secures modern and legacy systems. The YubiKey supports WebAuthn/FIDO2, FIDO U2F, one-time password (OTP), OpenPGP 3, and smart card authentication offering a solution that bridges legacy and modern applications. Yubico and the YubiKey will continue to grow with your evolving business needs.

Explore More ›
What are the authentication options for FIDO2? ›

FIDO2 authentication options
  • Passwordless authentication. Strong single factor authentication using a hardware authenticator, eliminates the need for weak password-based authentication.
  • Two factor authentication. ...
  • Multi-factor authentication. ...
  • YubiKey 5 Series. ...
  • Security Key Series by Yubico.

Continue Reading ›
What devices are FIDO2 security keys? ›

FIDO and FIDO2 Security Keys
  • Certificate-Based Smart Cards.
  • SafeNet IDPrime Smart Cards.
  • SafeNet IDCore Java Cards.
  • SafeNet IDPrime PIV Card.

Show Me More ›

What is the difference between Microsoft Authenticator and Microsoft Entra? ›

Microsoft Entra ID lets you choose which authentication methods can be used during the sign-in process. Users then register for the methods they'd like to use. The Microsoft Authenticator authentication method policy manages both the traditional push MFA method and the passwordless authentication method.

Read The Full Story ›
Is Entra ID free? ›

Azure AD Premium P1 is now Microsoft Entra ID P1. The free edition of Microsoft Entra ID is included with a subscription of a commercial online service such as Azure, Dynamics 365, Intune, Power Platform, and others.

See Details ›
Who uses Entra ID? ›

What type of organizations need Microsoft Entra ID? Any organization that has a subscription to Microsoft's online business services, like Microsoft 365, it automatically gains access to Microsoft Entra ID.

Get More Info Here ›
How do I set up passwordless entra ID? ›

To set this up you can go to the Azure portal as a global administrator, click on Entra ID then on Security -> Conditional Access Policies -> New Policy. Name your policy, set a handful of test users to test the policy (you don't want to lock out your users), Select the applications you want to enforce this policy on.

Continue Reading ›
How do I set up passwordless entra? ›

To enable the authentication method for passwordless phone sign-in, complete the following steps:
  1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
  2. Browse to Protection > Authentication methods > Policies.
  3. Under Microsoft Authenticator, choose the following options:

View More ›
How does Microsoft Entra ID work? ›

App developers can use Microsoft Entra ID as a standards-based authentication provider that helps them add single sign-on (SSO) to apps that works with a user's existing credentials. Developers can also use Microsoft Entra APIs to build personalized experiences using organizational data.

View Details ›
What browsers support YubiKey? ›

Linux
BrowserUsername with YubiKeyYubiKey + PIN*
ChromeYesYes
FirefoxYesYes**
Last updated July 30th 2023
Sep 23, 2020

See More ›
Does Bitwarden use FIDO2? ›

Two-step login using FIDO2 WebAuthn credentials is available for free to all Bitwarden users. Any FIDO2 WebAuthn Certified credentials can be used, including security keys such as YubiKeys, SoloKeys, and Nitrokeys, as well as native biometrics options like Windows Hello and Touch ID.

Learn More ›
Does Android support FIDO2? ›

The FIDO2 API allows Android applications to create and use strong, attested public key- based credentials for the purpose of authenticating users.

Discover More Details ›
What browsers does Secret Server support? ›

Secret Server is a web-based application that can be accessed via any platform. The four major web browsers—Internet Explorer, Firefox, Safari and Chrome—are fully supported.

Show Me More ›
Top Articles
INFORMAL ASSESSMENT IN EDUCATIONAL EVALUATION:
28 Of The Biggest Open World Games Based On The Size Of Their Maps
Appliances near Bloomfield Hills, MI - craigslist
24/7 Heaven Dispensary
Latest Posts
Tether Wallet | Ledger
Edovia Support
Article information

Author: Gov. Deandrea McKenzie

Last Updated:

Views: 5909

Rating: 4.6 / 5 (46 voted)

Reviews: 93% of readers found this page helpful

Author information

Name: Gov. Deandrea McKenzie

Birthday: 2001-01-17

Address: Suite 769 2454 Marsha Coves, Debbieton, MS 95002

Phone: +813077629322

Job: Real-Estate Executive

Hobby: Archery, Metal detecting, Kitesurfing, Genealogy, Kitesurfing, Calligraphy, Roller skating

Introduction: My name is Gov. Deandrea McKenzie, I am a spotless, clean, glamorous, sparkling, adventurous, nice, brainy person who loves writing and wants to share my knowledge and understanding with you.