Add an Allthenticate passkey to your Microsoft account

<aside> 🛑

Your Entra environment must first be configured to allow passkeys. Microsoft Environment Setup

</aside>

⚠️ Before you continue: Your Entra environment must first be configured to allow passkeys Admin-Only Setup section (at the bottom of this guide) before this step will work. If you're unsure, ask your admin to confirm that FIDO2 passkeys and the Allthenticate AAGUIDs have been enabled in Entra.

Go to myaccount.microsoft.com and sign in with your work account.
Navigate to Security Info.
Click Add sign-in method and select Security Key.
Follow the on-screen prompts:
- When asked "Choose the type of security key you have" → select USB Device (this is expected — Allthenticate uses the FIDO2 security key protocol over Bluetooth).
- Click Next.
- Under "Choose where to save this passkey" → select Security Key, then click Next.
- Click OK, then click OK again on the "Continue setup" screen.
- A prompt will appear on your phone — complete the biometric verification and name your passkey.
The passkey should now appear under your Security Info as a Security key.
Restart your PC and use the FIDO passkey option on the login screen to sign in.

Enable Security Key Sign-in (Group Policy)

This step enables the "Security Key" option on the Windows login screen. It needs to be done on each device (or pushed via Intune — see Troubleshooting).

Press the Windows key and type gpedit.
Right-click and select Run as administrator.
Click Yes when prompted.
Navigate to: Computer Configuration → Administrative Templates → System → Logon.
Double-click Turn on security key sign-in, select Enabled, then click OK.
Close the Group Policy Editor and reboot to apply changes.

:bluetooth: Bluetooth Resources

How to check if your Bluetooth adapter supports BLE Peripheral Mode