Register passkeys in Authenticator on Android or iOS devices (preview)

This article shows how to register a passkey using Microsoft Authenticator on your iOS or Android device by directly signing into the Authenticator app or by using My Security info. For more information on the availability of Microsoft Entra ID passkey (FIDO2) authentication across native apps, web browsers, and operating systems, see Support for FIDO2 authentication with Microsoft Entra ID.

Note that the easiest and fastest way to add a passkey is to add it directly in the Authenticator app.

Alternatively, you can add a passkey from your mobile device browser, or through cross-device registration using another device, such as a laptop. Your mobile device needs to run iOS version 17, or Android version 14, or later.

Scenario	iOS	Android
Same-device registration by signing into Authenticator	✅	✅
Same-device registration in a browser	✅	❌1
Cross-device registration	✅	✅

¹ Support for same-device registration in a browser on Android is coming soon.

iOS

Same device registration using direct sign in to Authenticator (iOS)

You can sign in to Authenticator to create a passkey in the app and get seamless single sign-on (SSO) across Microsoft native apps. This is the recommended and preferred flow to setup a passkey in Authenticator. If you're signed in or already have an account in Authenticator, you still need to complete these steps to add a passkey in Authenticator.

1. Open Authenticator.

2. Tap Add account or the + button.

   Note

   If you already have an account in Authenticator, you still need to tap on the + button to sign in and register a passkey for that same account.

   

3. Select Work or school account.

   

4. Tap Sign in.

   

5. You need to complete multifactor authentication (MFA).

   

6. Select Open Settings to enable Authenticator as a passkey provider.

   

7. Open Passwords, then select Password Options.

   

8. Ensure Autofill Passwords and Passkeys is turned on.

   

9. In the Use Passwords and Passkeys From option, make sure Authenticator is selected.

   

10. Authenticator sets up passkey, passwordless, and MFA for sign in according to your work or school account policies.

    

11. Tap Continue to complete the registration process.

Same-device registration from a browser (iOS)

You can also use your web browser to set up a passkey in Authenticator.

1. Using your iOS device, open a web browser and sign-in to My Security info.

   

2. Tap + Add sign-in method.

   

3. Select Passkey in Microsoft Authenticator (preview).

   

4. Tap Add.

   

5. Sign in with multifactor authentication (MFA) before adding a passkey.

   

   After you sign in with MFA, continue through the rest of the passkey setup.

6. If necessary, download Microsoft Authenticator and tap Next.

   

7. Follow the steps to turn on Authenticator as a passkey provider in the Settings of your iOS device:

   • On your iOS device, open Settings.
   • Open Passwords, and select Password Options.
   • Ensure Autofill Passwords and and Passkeys is turned on.
   • Under Use Passwords and Passkeys From, select Authenticator.
   • Return to My Security info and select Continue.

   

8. When ready, read the reminder that you must save the passkey in Authenticator, and tap I understand to continue.

   

9. Your device opens a security window. Save the passkey to Authenticator following the prompts on your device.

   

10. Once the passkey is successfully created on your device, you're directed back to My Security info.

11. Name the passkey something memorable to you, and select Done.

    

12. You can now see the passkeys in Authenticator along with your other registered security info options.

    

Cross-device registration (iOS)

You can also save a passkey in Authenticator from your computer or another mobile device. This registration option requires Bluetooth and an internet connection for both devices.

1. Using another device, such as a laptop, open a web browser and sign in to My Security info.

2. Tap + Add sign-in method > choose Passkey in Microsoft Authenticator (preview) > Add.

   

3. Sign in with multifactor authentication (MFA), then tap Next.

   

4. If necessary, download Microsoft Authenticator, then tap Next.

   

5. Tap iOS.

   

6. Follow the steps to turn on Authenticator as a passkey provider in Settings of your iOS device:

   • On your iOS device, open Settings.

   • Open Passwords select Password Options.

   • Ensure Autofill Passwords and and Passkeys is turned on.

   • Under Use Passwords and Passkeys From select Authenticator.

   • Return to My Security info, and select Continue.

     

7. Open the camera app on your mobile device.

   Note

   The camera inside the iOS Authenticator app doesn't support scanning a WebAuthn QR code. Make sure you use the system camera app.

8. When ready, read the reminder on My Security info that you must save the passkey in Authenticator, and tap Next to continue.

   

9. A security dialog opens on your device.

10. Tap iPhone, iPad, or Android device, then tap Next.

    

    Note

    The displayed options can vary on different browsers and devices. If the device where you started the registration process supports passkeys, you're asked to save the passkey to that device. Select Use another device or More options to see other ways you can save the passkey.

11. Use the system camera app to scan the QR code, then tap Save a passkey.

    

12. Your iOS device should now connect over Bluetooth to the device you started registration with.

    

    Note

    Bluetooth and an internet connection is required for this step and must be enabled on both your mobile and remote device.

13. Your iOS device opens a security window. Save the passkey to Authenticator following the prompts on your device.

    

14. Once the passkey is successfully created on your device, you're directed back to My Security info, tap Done.

15. Name the passkey something memorable to you and select Done.

    

Delete your passkey in Authenticator for iOS

To remove the passkey from Authenticator, click the Trash icon, then tap Delete to confirm.

Note

You also need to delete the passkey from My Security info.

Troubleshooting

In some cases when you try to register a passkey, it gets stored locally in the Authenticator app but not registered on the authentication server. For example, the passkey provider might not be permitted, or the connection might time out. If you try to register a passkey and see an error that the passkey already exists, delete the passkey that was created locally in Authenticator, and retry registration.

Android

Same device registration using direct sign in to Authenticator (Android)

You can sign in to Authenticator to create a passkey in the app and get seamless single sign-on (SSO) across Microsoft native apps. This is the recommended and preferred flow to setup a passkey in Authenticator. If you're signed in or already have an account in Authenticator, you still need to complete these steps to add a passkey in Authenticator.

1. Open Authenticator.

2. Tap Add account or the + button.

   Note

   If you already have an account in the Authenticator, you need to still tap on the + button to sign in and register a passkey for that same account.

   

3. Select Work or school account.

   

4. Tap Sign in.

   

5. You need to complete multifactor authentication (MFA).

   

6. Select Settings to enable Authenticator as a passkey provider.

   

7. Open Passwords and accounts.

   

8. In the Additional providers section, make sure Authenticator is selected.

   

9. Return to Authenticator app and select Done.

   

10. Authenticator sets up passkey, passwordless, and MFA for sign in according to your work or school account policies.

    

Same-device registration from a browser (Android)

Note

Passkeys in Authenticator don't work with browsers like Google Chrome or Microsoft Edge on Android devices. Support to create and sign in using Authenticator passkeys from browsers depends upon API updates to be made available by the Android platform.

Cross-device registration (Android)

You can also save a passkey in Authenticator from your computer or another mobile device. This registration option requires Bluetooth and an internet connection for both devices.

1. Open a web browser and sign in to My Security info.

2. Tap + Add sign-in method > choose Passkey in Microsoft Authenticator (preview) > Add.

   

3. Sign in with multifactor authentication (MFA), then tap Next.

   

4. If necessary, download Microsoft Authenticator, then tap Next.

   

5. Tap Android.

   

6. Follow the steps to turn on Authenticator as a passkey provider in Settings on your Android device:

   • On your Android device, open Settings.
   • Open Passwords & Accounts.
   • Under Additional providers enable Authenticator.
   • Return to My Security info and select Continue.

   Note

   The steps to turn on a passkey provider on Android can vary on different devices. Search for passkey on your device settings or check your device help.

   

7. Open the system camera app on your mobile device, or tap Add work or school account > Scan QR Code to use the camera in the Authenticator.

8. When ready, read the reminder that you must save the passkey in Authenticator, and tap Next to continue.

   

9. In the security dialog that opens on your device, tap iPhone, iPad, or Android device, and tap Next.

   

   Note

   The displayed options can vary on different browsers and devices. If the device where you started the registration process supports passkeys, you're asked to save the passkey to that device. Select Use another device or More options to see other ways you can save the passkey.

10. Use the camera you have opened to scan the QR code, and then tap Use passkey.

    

    Note

    For quicker sign-in, Android allows you to remember some browsers and Windows devices after scanning the WebAuthn QR code. In such cases, instead of having to scan a QR code each time, the device will appear as a selectable option, and you'll receive a notification on your mobile device to continue the passkey authentication.

11. Your Android device should now connect over Bluetooth to the device you started registration with.

    

    Note

    Bluetooth and an internet connection are required for this step and both must be enabled on your mobile and remote device.

12. Your device opens a security window. Save the passkey to Authenticator following the prompts on your device.

13. Once the passkey is successfully created on your device, you're directed back to My Security info.

14. Name the passkey something memorable to you and select Done.

    

Delete your passkey in Authenticator for Android

To remove the passkey from Authenticator, click the Trash icon, then tap Delete to confirm.

Note

You also need to delete the passkey from My Security info.

Troubleshooting

In some cases when you try to register a passkey, it gets stored locally in the Authenticator app but not registered on the authentication server. For example, the passkey provider might not be permitted, or the connection might time out. If you try to register a passkey and see an error that the passkey already exists, delete the passkey that was created locally in Authenticator, and retry registration.