When I go to add PassKeys to my MIcrosoft 365 portal it fails at the last step. https://mysignins.microsoft.com/security-info Same error in Chrome and Brave. I was able to cancel the 1Password enrollment process and enroll a YubiKey just fine. 1Password Version: 1Password for Mac 8.10.7 (81007041) Extension Version: 2.12.0 OS Version: 13.4 Browser:_ Brave

Confirming I have the exact same problem following the steps sukka mentioned.

I came across the same AAGUID. Although we have now the option to select "passkey (preview)", it still errors when trying to add a passkey, no matter what kind.

(Note, I happened to be on page 1 on an old open tab when I started this, and didn't see the replies just above from alcyone7 and duscu and others with similar information, but I gathered a few more details (and words, haha) even though they appear to be just as accurate, so the below is an "also" and not entirely new to the thread--wish I'd seen the above replies before my conversation with JefTek, it would have helped clarify a bit!) I wanted to update this to let folks know that Microsoft has enabled Passkeys as a preview for Microsoft 365/Entra ID accounts, BUT only "device-bound" Passkeys and ONLY initially using the Microsoft Authenticator app on iOS and Android. You also need to make the Authenticator app, on iOS at least, your "primary" additional Passkey app (other than iCloud Keychain, which can also be simultaneously enabled), but you can only have ONE non-Apple Passkey app. And 1Password is mine. Which means I can't use Microsoft 365 Entra ID Passkeys yet, because I'd have to make MS Authenticator the Passkey provider on iOS and not 1Password. However, Microsoft said that before the end of 2024 they will also roll out "syncable" Passkey support (the kind that 1Password uses, along with many other password managers and some of the platform tools/browsers. However, they will need to be explicitly enabled (as device-bound ones do now) by an administrator. And, you'll have to/need to determine which "AAGUID" values you'll accept--every Passkey provider generates a unique AAGUID for authenticators with the same features. So Yubico's Yubikeys (which also can save device-bound Passkeys and have worked with Microsoft Entra ID for years as FIDO2 keys) have AAGUIDs per "family" depending on the features of each key. You can authorize as many or as few AAGUIDs as you want for a particular Microsoft tenant (or even a Custom Authentication Strength you can define and assign to particular groups/users or even certain applications), so administrators have control over which Passkeys they will accept instead of usernames and passwords. I think this control for business accounts is a good thing, but I'm disappointed I can't enable the 1Password AAGUID yet! (Well, I can and did, but it doesn't work since Microsoft only enables those for Authenticator--you actually have to add iOS and Android Authenticator App AAGUIDs to your allow list explicitly even to test the public beta!). If you're curious, you can see a list of known password manager AAGUIDs here, including 1Password's: https://passkeydeveloper.github.io/passkey-authenticator-aaguids/explorer/ That is generated from this GitHub repository collecting them for easy use, and they are available in several programmer-friendly formats also: https://github.com/passkeydeveloper/passkey-authenticator-aaguids And you can see how Yubikeys have various AAGUIDs based on which model/features each hardware keys has from Yubico's own list, here: https://support.yubico.com/hc/en-us/articles/360016648959-YubiKey-Hardware-FIDO2-AAGUIDs The Microsoft information above was pulled from a reasonably long discussion I had in the last few weeks with Jef Kazimer (JefTek) of https://jeftek.com/ (he's a Principal Project Manager for Microsoft Entra ID at Microsoft) in an Entra-related Discord server, and is a summery of a longer discussion. I really hope (and asked for) syncable Passkey support ASAP! Oh, and Microsoft's official documentation to enable Passkey support is located at https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 and the purple callout near the top does (if you know what they are!) explicitly list that device-bound Microsoft Authenticator Passkeys (in addition to physical security keys) are the only ones supported now but that synced passkey is being worked on: For reference I have a screenshot of the iOS Passkey app configuration screen showing where you can enable or disable iCloud Keychain (I have it disabled in the screenshot) and ONE other Passkey app--I have 1Password selected, but if I choose Authenticator, 1Password switches to disabled and vice-versa: I don't know if there's a way for 1Password to detect if a credential that's saved for login.microsoftonline.com right now is for a Microsoft Personal/Family account (used to be a Live ID many years ago), or if the credential is for a Microsoft 365 Work/Entra ID business tenant account. If they can tell automatically, it would be nice for their "Passkey is available!" alert at the top of a saved item for Microsoft to be smarter about not presenting that alert for Entra ID accounts until synced passkeys are supported in Entra ID, and when they are, to link to the setup page (like the above document) because each tenant will need explicit configuration before 1Password Passkeys (or any!) will work--maybe they should write a blog post at that time and walk people through the steps for 1Password at least. Oh, and one more thing, and you can do this now! I went to https://www.apple.com/feedback/iphone/ and submitted the following feature request to Apple about allowing multiple secondary (non-iCloud Keychain) Passkey apps in a future iOS update, and you can easily submit the same request so they get more feedback! Mine looked like this as an example:

It looks like people have said that iOS 18 Beta includes the ability to have at least 3 Passkey-enabled apps including their own, which would allow 1Password and the Microsoft Authenticator app to co-exist as Passkey providers on the same iPhone. Yay! At least, when iOS 18 goes GA this Fall...

It does look like Passkeys are currently just limited to Microsoft Authenticator. Having said the above, I have put in a query to Microsoft Support to see if there is any movement on this on the horizon, as a synched Passkey would be very helpful for a lot of us.

Passkeys do not work with Microsoft 365

steph_giles
1Password Team
2 years ago
Hey @dcoletta, OAW, ajh0912, wavesound,

Apologies for any confusion caused, passkeys are not yet available on Microsoft 365 work/school accounts it seems its only personal Microsoft accounts.
steph_giles
1Password Team
2 years ago
Thank you @eenturk!
sukka
New Contributor
2 years ago
It is Oct 21 2023 now and the 1Password Chrome Extension + Passkey still does not work for Microsoft 365.

The way to reproduce:

The system admin should have enabled FIDO2 in the "Authentication methods | Policies" at "Microsoft Entra Admin Center": https://entra.microsoft.com/

Go to "Microsoft 365 My Sign-Ins > Security Info" at https://mysignins.microsoft.com/security-info

Click "Add sign-in method"

Select "Security key" in the dropdown menu, then click "Add":

Click "USB Device", then click "Next":

Microsoft 365 will redirect to a new page to setup the security key, where the 1Password Chrome Extensions popup will show up as expected. Save the passkey in the 1Password popup.

After the passkey is saved in 1Password, the Microsoft 365 will redirect back to the last step:

After typing in the name, click "Next". Microsoft 365 then will fail to save the Passkey:
Former Member
2 years ago
"Beginning January 2024, Microsoft Entra ID will support device-bound passkeys stored on computers and mobile devices as an authentication method in public preview, in addition to the existing support for FIDO2 security keys. This enables your users to perform phishing-resistant authentication using the devices that they already have."

https://janbakker.tech/prepare-for-passkeys-in-entra-id/

https://learn.microsoft.com/en-us/entra/fundamentals/whats-new#public-preview---device-bound-passkeys-as-an-authentication-method
gussic
Contributor
12 months ago
Confirming I am still unable to add a Passkey for my (work) Microsoft 365 account... The correct policies are enabled in Entra so I am not sure what the problem is...
duscu
New Contributor
10 months ago
I think the confusion comes from the different kind of passkey types: "Device-bound" (currently supported) and "Synced or multi-device" (not yet supported and 1password would be in this category).

I gave up hopes for now when I read this blog post where it's well explained:

https://www.corbado.com/blog/entra-passkeys#synced-passkeys-at-microsoft
alcyone7
New Contributor
10 months ago
Passkeys for Microsoft 365 will depend on a couple of factors - the main being where the authentication comes from at Microsoft. If this is coming from Entra (Work/School users) then the rollout for passkeys has been pushed several times since it was announced back in Sept '23... but the partially good news is that they have announced recently that they expect to globally rollout passkey support by end of the April '24 and be completed by May '24. The caveat is that Microsoft will only allow DEVICE-BOUND passkeys, so 1Password will continue to be rejected (as per the OP screenshot) as the 1Password passkey system is considered transportable (the AAGUID will be blocked by MS).

If your authentication is for a personal account, then passkey support has been available for some time, both device-bound (Yubico 5/ WebAuthn keys) as well as PWM-based passkeys.

Unfortunately, this is NOT a 1Password issue to resolve - it is how MS have specificialy/purposefully designed it; and nothing in any of the developer (or Entra ID) notices to admins suggest they are likely to support non-device-bound passkeys in a non-personal MS account any time soon.
Backspaze
Frequent Contributor
4 months ago
Microsoft has released more information.

Microsoft Entra: Enablement of Passkeys in Authenticator for passkey (FIDO2) organizations with no key restrictions

Beginning mid-January 2025, after the General Availability of passkeys in the Microsoft Authenticator app, organizations with the passkey (FIDO2) authentication methods policy enabled with no key restrictions will be enabled for passkeys in the Microsoft Authenticator app in addition to FIDO2 security keys. This update aligns with the broader availability of passkeys in Entra ID, extending from device-bound passkeys on security keys to device-bound passkeys also on user devices. Users who navigate to aka.ms/MySecurityInfo will see "Passkey in Microsoft Authenticator" as an authentication method they can add. Additionally, when Conditional Access (CA) authentication strengths policy is used to enforce passkey authentication, users who don't yet have any passkey will be prompted inline to register passkeys in Authenticator to meet the CA requirements. If an organization prefers not to enable this change for their users, they can work around it by enabling key restrictions in the passkey (FIDO2) policy. This change will not impact organizations with existing key restrictions or organizations that have not enabled the passkey (FIDO2) policy.

When this will happen:

General Availability (Worldwide, GCC, GCC High, DoD): Rollout will happen mid-January 2025.

How this will affect your organization:

Who will be impacted: Organizations with the passkey (FIDO2) authentication methods policy enabled with no key restrictions set.

Who will not be impacted: Organizations that do not have the passkey (FIDO2) authentication methods policy enabled and organizations that have the passkey (FIDO2) authentication methods policy enabled and have key restrictions set.

What you need to do to prepare:

This rollout will happen automatically with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.
aared
New Contributor
11 days ago
According to the post from Backspaze on Page 2, it should be ready by now (estimated mid-Jan 2025). I'm 99% there but then it fails:

Microsoft admin can enable passkeys through the portal on entra.microsoft.com
and can avoid enabling key restrictions (disabled by default)

which allows non-microsoft-authenticator passkey creation
and it gets to the last step
but then it fails
Former Member
2 years ago
Contrary to what the passkey key directory site by 1Password says, Microsoft don’t support them yet