Passkeys aren’t the finish line: Eliminating fallbacks and fixing recovery

Every year, World Passkey Day gives us an opportunity to reflect on how far we’ve come in moving beyond passwords—and how much further we still need to go. Billions of accounts are protected by passkeys worldwide. At Microsoft, hundreds of millions of people use passkeys every day. The progress is real.

But deploying a strong sign-in method isn’t enough if attackers can get around it. According to the Microsoft Digital Defense Report, AI-driven phishing campaigns are achieving click-through rates as high as 54%. Impersonation attacks—deepfakes, SIM swaps, and social engineering of help desks—target the moments when a user isn’t signing in: when they’re locked out, recovering access, or calling IT to prove who they are. In an enterprise where AI agents act autonomously on behalf of users, a compromised identity isn’t just a stolen mailbox—it’s an attacker operating agents and triggering actions at machine speed.

These attack paths expose three critical gaps that organizations must close.

Three gaps attackers exploit

Even in an organization that has deployed passkeys, a sophisticated attacker still has options:

Gap 1 · Phishable sign-in methods. Passwords, SMS codes, push notifications — as long as users sign in with these methods, the sign-in moment remains vulnerable.

Gap 2 · Dormant credentials. Even after passkeys are deployed, most accounts still have a password or SMS method attached "just in case." The user doesn't use it. The attacker does.

Gap 3 · Weak recovery channels. Recovery typically means calling a helpdesk and answering knowledge-based questions—information easily available from social media and data breaches. In an era of AI-generated deepfakes, that isn’t verification.

Here's how we're closing each one.

Closing gap 1—passkeys on every platform, for every user

Over the past year, synced passkeys have become the default sign-in method for hundreds of millions of Microsoft account users — across every major operating system, device type, and browser. Our consumer users are 3× more successful signing in with passkeys than with legacy methods (95% vs. 30%), and sign-ins are 14× faster compared to password-plus-code MFA. These aren't lab results — that's what we've measured across one of the most diverse, heterogeneous user bases on the internet.

Our consumer and enterprise identity platforms share a common foundation, so every usability improvement we make for Microsoft account users—registration flows, error handling, cross-device sync—reaches Microsoft Entra ID and Microsoft Entra External ID customers too. We’re thrilled to bring these advances to our enterprise customers—for workforce and external users alike.

Think about what sign-in looks like for most enterprise users right now. Type a password. Switch to your phone. Approve a push notification — or copy an SMS code — then switch back to the browser. On mobile, it's even worse: juggling between an authenticator app and the app you're trying to reach, losing context along the way. Every one of those steps is friction for the user and a phishable surface for an attacker.

Synced passkeys—now generally available for external users and already available for workforce users—change that completely. The employee taps a fingerprint or glances at their camera, on any device, and they’re in. Phone, browser, laptop. No password, no code, no app switching. The passkey syncs across devices via iCloud Keychain, Google Password Manager, Microsoft Password Manager or other platform credential managers, so it works wherever they work. The same seamless experience extends to your customers through Microsoft Entra External ID—passkey sign-in out of the box for customer-facing applications, with no custom integration.

 

Sign in experience with synced passkeys.

And now, Windows. Contractors, frontline workers, and bring-your-own-device (BYOD) users on unmanaged Windows devices have historically fallen back to passwords and SMS—because managed device enrollment wasn’t practical. With Microsoft Entra passkeys on Windows, they create a device-bound passkey using Windows Hello—face, fingerprint, or PIN—directly on their own device. No enrollment. No hardware token to ship.

General availability is a milestone, not a finish line. We're continuing to invest in making passkeys the default experience — not just an option:

• Passkey profiles— Group-based passkey policies: attestation requirements, passkey type, specific provider selection — applied differently to different user groups.
• Passkey-preferred authentication (preview)—Detects registered methods and prompts the strongest one first. If a passkey is registered, that’s what the user sees immediately.

   

Passkey profiles for granular admin control.

Synced passkeys are the simplest path for most users — and for high-privilege roles or regulated industries, Microsoft Entra ID continues to support device-bound passkeys, Microsoft Authenticator passkeys, and FIDO2 security keys. With passkey profiles, admins deploy both side by side in the same tenant.

Close the fallback gap—and the recovery gap it reveals

Deploying passkeys improves sign-in. But most accounts still have a password or SMS method attached “just in case”—and as long as those credentials exist, they’re an attack surface. Admins can now remove phishable credentials from user accounts entirely. At Microsoft, we’ve rolled out phishing-resistant authentication to 99.9% of our users and devices, eliminating weaker methods from our own accounts.

⚠️ Deprecation notice: Security questions for password reset in Microsoft Entra ID will be deprecated starting March 2027. If your organization still uses knowledge-based recovery, now is the time to migrate to high-assurance account recovery.

Removing phishable credentials is the right move—but it raises an important question. Synced passkeys handle the most common lockout scenario by design: lose one device, your passkey is still on your other devices. But device-bound passkey users—including those on FIDO2 security keys and Windows Hello—don’t get cross-device sync. And for any user who loses all their credentials, recovery today still means helpdesk calls, temporary passwords, and knowledge-based questions that are easily guessable. That’s the weakest link.

Reduce impersonation—verified account recovery

Picture what happens when an employee gets locked out. They call the helpdesk, wait on hold, answer questions an attacker could guess from a LinkedIn profile, and eventually receive a temporary password—which they then have to change immediately. Twenty to thirty minutes: frustrating for the user, expensive for the organization, and vulnerable to social engineering.

Microsoft Entra ID account recovery—now generally available—replaces all of that. The employee opens any browser, selects “Recover my account,” scans their driver’s license, takes a quick selfie, and registers a new passkey—all in minutes, without a phone call, and with controls that are harder to spoof. Since preview, we’ve expanded identity verification (IDV) provider coverage, added recovery profiles for regional compliance, and refined the end-user flow based on customer feedback across 192+ countries.

As NIST recommends, high-assurance recovery requires government-issued ID and biometric verification. We've made it simple — setup takes minutes, not months:

1. Verify identity with a government-issued ID — driver's license, passport, or other supported document
2. Complete a live face check—Face Check in Microsoft Entra Verified ID, powered by Azure AI, matches a real-time selfie with the photo on the identity document
3. Match verified attributes against the organization's directory and HR system via custom authentication extensions
4. Register a synced passkey immediately — so the user is protected going forward

Only the match result is shared — never the sensitive identity data itself. Privacy is preserved. And this is what makes removing phishable fallbacks safe: the recovery channel is now harder to compromise than the primary authentication.

Account recovery user flow.

Ericsson: Phishing-resistant MFA is one of those rare opportunities that strengthens security while simultaneously improving the employee experience. Ericsson has been at the forefront of this journey since 2020, early adopting Microsoft’s passwordless technologies—what we today refer to as passkeys or phishing-resistant MFA. Our approach has been to seamlessly integrate passkeys into managed user devices, such as Windows Hello for Business and passkeys in Microsoft Authenticator, complemented by FIDO2 security keys (YubiKey 5-series) for high-risk and privileged use cases—delivering strong protection with simplicity and peace of mind for users.

Easy to set up, flexible by design

Admins configure recovery in a few steps: choose an IDV provider from the Microsoft Security Store, assign user groups, and optionally match verified attributes against HR data via custom authentication extensions. You can simulate the entire flow before activating it for production. Just like passkey profiles, account recovery profiles let admins assign different IDV providers by region or country to meet local regulatory requirements.

Through the Microsoft Security Store, customers can choose from leading IDV providers—Au10tix, IDEMIA, TrueCredential (LexisNexis), 1Kosmos, and CLEAR1—without custom business contracts or bespoke integrations. These providers cover most government-issued ID documents across 192+ countries.

 

Bringing it all together

 

Each capability is valuable on its own. Together, they close the entire credential lifecycle — not just the sign-in moment, but everything before and after.

Licensing and availability

Get started

We've been on this journey together — from introducing these capabilities at Ignite 2025, to the general availability we're announcing today. Tens of thousands of organizations helped shape these experiences during preview.

Passkeys make sign-in faster and phishing-resistant. Verified identity makes recovery seamless and impersonation-proof. Credential removal closes the fallback gap. Together, there's no weak link left.

This matters even more as AI reshapes how work gets done. Every agent that acts on behalf of a user, every automated workflow that touches sensitive data, every copilot that executes a decision — all of it traces back to an identity. The person using, developing, and managing these agents must be securely verified. Passkeys and verified recovery ensure that identity is genuine, from sign-in to recovery. That's the foundation safe AI is built on.

And we're just getting started.

We love hearing from you — share your feedback and let us know how it's going.

Ankur

Ankur Patel | LinkedIn

 

Additional resources

• Enable passkeys for your organization
• Enable high-assurance account recovery
• Passwordless deployment guide

 

Learn more about Microsoft Entra

Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.

• Microsoft Entra News and Insights | Microsoft Security Blog
• Microsoft Entra blog | Tech Community
• Microsoft Entra documentation | Microsoft Learn
• Microsoft Entra discussions | Microsoft Community