Microsoft Entra External ID
AuthenticationSign In With Passkey
In brief
The documentation no longer directs applications to the preview credential management API. It now recommends Microsoft Graph FIDO2 provisioning APIs and states that low-privilege passkey credential management APIs are on the roadmap.
What Entra admins need to know
Use the FIDO2 provisioning APIs when planning or implementing customer passkey management; no immediate administrator action is stated.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
ms.topic: how-to
author: mmacy-msft
ms.author: marshmacy
ms.date: 07/23/09/09/2026
ai-usage: ai-assisted
ms.custom: it-pro, msecd-doc-authoring-1017
#Customer intent: As a developer or IT admin, I want to enable passkey (FIDO2) sign-in for my external tenant so that customers can use phishing-resistant, passwordless authentication.
Step 3: Build a passkey management experience for your application
Your application needs a credential management experience so signed-in customers can register and manage their own passkeys. Use the preview credential management APIFIDO2 provisioning APIs to build this experience with low-privilege delegated permissions.into your app.
The credential management experience should enable customers to:
Are there low-privilege APIs for building a credential management experience?
Yes. UseNot yet. Low-privilege credential management APIs for passkeys are on the preview credential management APIroadmap. Currently, use the FIDO2 provisioning APIs to let signed-in customers list, register, and delete their own passkeys with delegated permissions.build your credential management experience.
Can I use the same passkey across multiple domains (related origins)?
Is there an out-of-box passkey registration experience?
No. Microsoft doesn't currently provide a built-in passkey registration experience for external tenants. Build a credential management experience in your application by using the preview credential management APIFIDO2 provisioning APIs.
Related content
@@ -5,7 +5,7 @@ ms.service: entra-external-id ms.topic: how-to author: mmacy-msft ms.author: marshmacy-ms.date: 07/23/2026+ms.date: 09/09/2026 ai-usage: ai-assisted ms.custom: it-pro, msecd-doc-authoring-1017 #Customer intent: As a developer or IT admin, I want to enable passkey (FIDO2) sign-in for my external tenant so that customers can use phishing-resistant, passwordless authentication.@@ -76,7 +76,7 @@ To configure a profile: ## Step 3: Build a passkey management experience for your application -Your application needs a credential management experience so signed-in customers can register and manage their own passkeys. Use the preview [credential management API](../../identity-platform/reference-credential-management-api.md) to build this experience with low-privilege delegated permissions.+Your application needs a credential management experience so customers can register and manage their passkeys. Use the [FIDO2 provisioning APIs](/graph/api/resources/fido2authenticationmethod) to build this into your app. The credential management experience should enable customers to: @@ -211,7 +211,7 @@ No. Registration requires the customer's physical presence and local biometric o ### Are there low-privilege APIs for building a credential management experience? -Yes. Use the preview [credential management API](../../identity-platform/reference-credential-management-api.md) to let signed-in customers list, register, and delete their own passkeys with delegated permissions.+Not yet. Low-privilege credential management APIs for passkeys are on the roadmap. Currently, use the [FIDO2 provisioning APIs](/graph/api/resources/fido2authenticationmethod) to build your credential management experience. ### Can I use the same passkey across multiple domains (related origins)? @@ -223,11 +223,11 @@ No. Passkeys aren't currently supported through native authentication APIs. Supp ### Is there an out-of-box passkey registration experience? -No. Microsoft doesn't currently provide a built-in passkey registration experience for external tenants. Build a credential management experience in your application by using the preview [credential management API](../../identity-platform/reference-credential-management-api.md).+No. Microsoft doesn't currently provide a built-in passkey registration experience for external tenants. Build a credential management experience in your application by using the [FIDO2 provisioning APIs](/graph/api/resources/fido2authenticationmethod). ## Related content -- [Credential management API for Microsoft Entra External ID](../../identity-platform/reference-credential-management-api.md)+- [FIDO2 authentication method API reference](/graph/api/resources/fido2authenticationmethod) - [Create a sign-up and sign-in user flow](how-to-user-flow-sign-up-sign-in-customers.md) - [Add multifactor authentication (MFA) to an app](how-to-multifactor-authentication-customers.md) - [Authentication methods in external tenants](concept-authentication-methods-customers.md)