User failed to register Passkey

Question

I briefly disabled the Security -> Authentication Methods -> Passkey (FIDO2) policy to test something. Since turning it back on, I can't complete login and setup for new user accounts. I'm creating a test account with Global Administrator role, then attempting to log in. I get pass the password page and am asked to set up the Authenticator app, which all works. Then I'm prompted to create a passkey and nothing works. I get an error in the user logs "User failed to register Passkey" The UI shows "Passkey not registered. We were unable to register the passkey you attempted to add. Please Try again."

Policy settings are:

• Allow Self-Service Setup = Yes
• Enforce Attestation = Yes
• Enforce Key Restrictions = No

I have tired Windows Hellos (fingerprint) as well as adding a passkey to Authenticator. Neither work. I can't add any new admin accounts because of this and I don't know how to fix it.

Answer 1

This is what works for me:

More info:

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2

Answer 2

Hello @David Wheat,

Thank you for reaching out to Microsoft Q&A. 

We understand that you are experiencing the below error when you are trying to register Passkeys: "Passkey not registered. We were unable to register the passkey you attempted to add. Please Try again." 

Hope the above suggestions by @Andy David - MVP worked for you.

In addition to that could you please change Enforce Attestation = No and check if you are able to register the passkeys. 

There are few other scenarios where this error may occur: If the used provider is not Microsoft Authenticator or Windows hello as Microsoft Entra ID currently supports device-bound passkeys stored on FIDO2 security keys and in Microsoft Authenticator. Ensure that you have added Authenticator as a passkey provider and also tried to register passkey from Security info page as suggested in the below document. https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-register-passkey-authenticator?tabs=iOS

Also, check if you have enabled authenticator app as a passkey provider in "Personal" profile? If yes click on the "Work" tab and enable Authenticator as a passkey provider there and try again? 

Hope this helps. Do let us know if you any further queries.

Thanks & Best Regards

Janaki Kota

Answer 3

Hello,

we've got the same error when creating passkeys with either authenticator or Windows Hello.

Thanks for the described solutions.

This problem is gone anyway, as soon as the Passkeys go GA and no key restrictions are necessary anymore, correct?

Regards,
Thomas