When I go to add PassKeys to my MIcrosoft 365 portal it fails at the last step. https://mysignins.microsoft.com/security-info Same error in Chrome and Brave. I was able to cancel the 1Password enrollment process and enroll a YubiKey just fine. 1Password Version: 1Password for Mac 8.10.7 (81007041) Extension Version: 2.12.0 OS Version: 13.4 Browser:_ Brave

Confirming I have the exact same problem following the steps sukka mentioned.

I came across the same AAGUID. Although we have now the option to select "passkey (preview)", it still errors when trying to add a passkey, no matter what kind.

(Note, I happened to be on page 1 on an old open tab when I started this, and didn't see the replies just above from alcyone7 and duscu and others with similar information, but I gathered a few more details (and words, haha) even though they appear to be just as accurate, so the below is an "also" and not entirely new to the thread--wish I'd seen the above replies before my conversation with JefTek, it would have helped clarify a bit!) I wanted to update this to let folks know that Microsoft has enabled Passkeys as a preview for Microsoft 365/Entra ID accounts, BUT only "device-bound" Passkeys and ONLY initially using the Microsoft Authenticator app on iOS and Android. You also need to make the Authenticator app, on iOS at least, your "primary" additional Passkey app (other than iCloud Keychain, which can also be simultaneously enabled), but you can only have ONE non-Apple Passkey app. And 1Password is mine. Which means I can't use Microsoft 365 Entra ID Passkeys yet, because I'd have to make MS Authenticator the Passkey provider on iOS and not 1Password. However, Microsoft said that before the end of 2024 they will also roll out "syncable" Passkey support (the kind that 1Password uses, along with many other password managers and some of the platform tools/browsers. However, they will need to be explicitly enabled (as device-bound ones do now) by an administrator. And, you'll have to/need to determine which "AAGUID" values you'll accept--every Passkey provider generates a unique AAGUID for authenticators with the same features. So Yubico's Yubikeys (which also can save device-bound Passkeys and have worked with Microsoft Entra ID for years as FIDO2 keys) have AAGUIDs per "family" depending on the features of each key. You can authorize as many or as few AAGUIDs as you want for a particular Microsoft tenant (or even a Custom Authentication Strength you can define and assign to particular groups/users or even certain applications), so administrators have control over which Passkeys they will accept instead of usernames and passwords. I think this control for business accounts is a good thing, but I'm disappointed I can't enable the 1Password AAGUID yet! (Well, I can and did, but it doesn't work since Microsoft only enables those for Authenticator--you actually have to add iOS and Android Authenticator App AAGUIDs to your allow list explicitly even to test the public beta!). If you're curious, you can see a list of known password manager AAGUIDs here, including 1Password's: https://passkeydeveloper.github.io/passkey-authenticator-aaguids/explorer/ That is generated from this GitHub repository collecting them for easy use, and they are available in several programmer-friendly formats also: https://github.com/passkeydeveloper/passkey-authenticator-aaguids And you can see how Yubikeys have various AAGUIDs based on which model/features each hardware keys has from Yubico's own list, here: https://support.yubico.com/hc/en-us/articles/360016648959-YubiKey-Hardware-FIDO2-AAGUIDs The Microsoft information above was pulled from a reasonably long discussion I had in the last few weeks with Jef Kazimer (JefTek) of https://jeftek.com/ (he's a Principal Project Manager for Microsoft Entra ID at Microsoft) in an Entra-related Discord server, and is a summery of a longer discussion. I really hope (and asked for) syncable Passkey support ASAP! Oh, and Microsoft's official documentation to enable Passkey support is located at https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 and the purple callout near the top does (if you know what they are!) explicitly list that device-bound Microsoft Authenticator Passkeys (in addition to physical security keys) are the only ones supported now but that synced passkey is being worked on: For reference I have a screenshot of the iOS Passkey app configuration screen showing where you can enable or disable iCloud Keychain (I have it disabled in the screenshot) and ONE other Passkey app--I have 1Password selected, but if I choose Authenticator, 1Password switches to disabled and vice-versa: I don't know if there's a way for 1Password to detect if a credential that's saved for login.microsoftonline.com right now is for a Microsoft Personal/Family account (used to be a Live ID many years ago), or if the credential is for a Microsoft 365 Work/Entra ID business tenant account. If they can tell automatically, it would be nice for their "Passkey is available!" alert at the top of a saved item for Microsoft to be smarter about not presenting that alert for Entra ID accounts until synced passkeys are supported in Entra ID, and when they are, to link to the setup page (like the above document) because each tenant will need explicit configuration before 1Password Passkeys (or any!) will work--maybe they should write a blog post at that time and walk people through the steps for 1Password at least. Oh, and one more thing, and you can do this now! I went to https://www.apple.com/feedback/iphone/ and submitted the following feature request to Apple about allowing multiple secondary (non-iCloud Keychain) Passkey apps in a future iOS update, and you can easily submit the same request so they get more feedback! Mine looked like this as an example:

It looks like people have said that iOS 18 Beta includes the ability to have at least 3 Passkey-enabled apps including their own, which would allow 1Password and the Microsoft Authenticator app to co-exist as Passkey providers on the same iPhone. Yay! At least, when iOS 18 goes GA this Fall...

It does look like Passkeys are currently just limited to Microsoft Authenticator. Having said the above, I have put in a query to Microsoft Support to see if there is any movement on this on the horizon, as a synched Passkey would be very helpful for a lot of us.

Passkeys do not work with Microsoft 365

OlivierP
Contributor
2 years ago
There are 2 kind of accounts from Microsoft:
- Microsoft accounts (personal ones : like with Outlook.com, Hotmail.com, Xbox etc.)
- Work or School accounts (professional ones : Office 365, Microsoft 365, Azure).

I have tested both:
- Microsoft accounts:
works when you add a security key
- Work or School accounts:
does not yet works
- Behavior observed: FIDO2 Security Key has to be activated by the tenant Admin

on the page: https://mysignins.microsoft.com/security-info, you can add a new method (choose Security Key)

Choose USB or NFC

1Password extension will popup letting you choose the account to use for the passkey.

However, on the naming step (Microsoft page): same error as in this post.

It seems Microsoft doesn't handle something.
leonardder
Occasional Contributor
2 years ago
I can reproduce both, i.e. I am able to add a Passkey to my personal Microsoft account in Edge. On Firefox, 1Password reported an unknown error before it was able to save the actual passkey. For work accounts, I also get stuck in the naming step.
leonardder
Occasional Contributor
2 years ago
I can still reproduce the issue with Microsoft 365 with version 2.12.2 of the Firefox extension.
leonardder
Occasional Contributor
2 years ago
@Joy_1P Thanks for the feedback!
Former Member
2 years ago
leonardder You're welcome!
Former Member
2 years ago
@Joy_1P Has there been any movement on this? After trying to reproduce again today it's still not functioning. Not sure if there's a beta we could try that may work. Thanks!
steph_giles
1Password Team
2 years ago
Hey @razeth,

I have taken a look at the internal issue and we are having some trouble reliably reproducing this one. Can you reproduce the issue and send over some additional details to help us with our investigation? Here's how: https://support.1password.com/cs/extension-console-log/.

Please attach the console log to an email message addressed to support+forum@1password.com with a link to this thread.

You should receive an automated reply from our BitBot assistant with a Support ID number. Please post that number here. Thanks very much!
Former Member
2 years ago
In 1Password, I see this for my entry for my work login to Microsoft 365:

But when I go through the “use passkey” flow, it takes me to a page whose URL starts with https://login.live.com/login.srf and when I try to log in, I get the error “That Microsoft account doesn't exist. Enter a different account or get a new one.”

That error is I believe due to the fact that there are different login URLs for Microsoft depending on whether it’s a home account or a work/school account.

I also notice that I only get offered the passkey option when microsoftonline.com is one of the websites listed for this login. So I’m guessing that it’s 1Password logic that is sending me to login.live.com, and I think it should be sending me to some other login page that works with a work/school account.

Is there a way I can tell 1Password to use the work/school login?

1Password Version: 8.10.16
Extension Version: 2.15.1
OS Version: macOS 13.6
Browser: Chrome
steph_giles
1Password Team
2 years ago
Hey @dcoletta,

You're right, at some point in the past, login.live.com and microsoftonline.com shared the same sign in credentials which has been added to our historical shared credentials list. This list combines login.live.com and microsoftonline.com under one domain so to speak, which explains why the Watchtower passkey banner is taking you to the incorrect page.

This is not the intended behaviour and I've gone ahead and raised this with our development team to investigate further, thank you for bringing this to our attention.

If you go directly to microsoftonline.com and sign in to your account, is there an option to add a passkey within your account settings?

ref: dev/core/core#24202
Former Member
2 years ago
It seems like there ought to be a way to add a passkey in account settings, but I can’t find it, and Google’s no help. https://mysignins.microsoft.com/security-info is where I would expect to see the option, but it’s not there: