How to clean up "Sign-in with your passkey" options

Question

Hello,

I have enabled FIDO2 as sign-in method and enforced it with CA policies for a pilot group. One of the users is seeing his phone as device with a saved passkey. Where did this option come from and how to disable it? The desired option is ONLY "Security Key", and I'd like to get rid of the other two.

Thanks!

Answer 1

Hi @Vladyslav Bondarchuk

Thank you for posting this in Microsoft Q&A.

I understand you want to keep passkeys stored on FIDO2 security keys and delete phone choice from the sign-in options .

If you are enabled FIDO2 as sign-in method and enforced, it with CA policies for a pilot group. You can get iPhone, iPad or Android device, Linked device, Security key. You can also choose to use a passkey from one of the above locations. Unfortunately, there is no way to delete phone choice from the sign-in options.

Please refer this document: https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/?tabs=windows#user-experiences

To remove a passkey associated with a user account, delete the key from the user’s authentication methods.: Delete a passkey

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If the answer is helpful, please click "Accept Answer" and kindly "upvote" it.

Answer 2

Passkeys for authenticator are now in preview with Entra:

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-authenticator-passkey

Was that enabled?