Microsoft and Google push passkeys deeper into workplace authentication

Microsoft and Google are pushing passkeys and hardware security keys deeper into workplace authentication, with Microsoft preparing to make passkeys the default authentication experience in Entra ID, and Google adding FIDO2-compliant security keys as a second factor in the Windows login process for Google Workspace users.

The announcements, both made Monday, represent different but related steps in the technology industry’s effort to move organizations away from passwords, texted verification codes, and other credentials that can be stolen, intercepted, or surrendered to a convincing phishing site.

Microsoft’s change is the more consequential of the two. Beginning September 1, the company will start rolling out passkeys as the default authentication experience in the public-cloud version of Microsoft Entra ID, its identity and access management platform.

As the rollout reaches each organization, users who are enabled for SMS or voice authentication will automatically be enabled for passkeys. The next time they perform multifactor authentication, Entra ID will prompt them to register a passkey.

Microsoft will then retire the telecom delivery service it provides for SMS and voice authentication on February 1, 2027. SMS and voice will no longer be offered as native Entra capabilities.

The company is not banning those methods outright. Organizations with regulatory, technical, or operational reasons to retain them will be able to contract with supported telecommunications providers through the Microsoft Security Store.

Customers, rather than Microsoft, will be responsible for the resulting carrier and delivery charges.

Microsoft plans to identify the participating providers and release pricing, commercial terms, and deployment guidance on September 18. Administrators will be able to select and configure a provider beginning October 30.

After Microsoft’s native SMS and voice service ends, users who use those methods for multifactor authentication will be required to register a passkey before they can sign in.

Microsoft said passkey registration prompts will eventually be enforced for all users in affected organizations, with no option for administrators to disable them.

The announced dates apply only to Microsoft Entra ID in the public cloud. Government and other Entra cloud environments will move to the new model under separate schedules that Microsoft has not yet announced.

The change does not mean that every Entra ID password will disappear on September 1. It instead changes the direction of Microsoft’s authentication system by making a phishing-resistant credential the expected method and turning Microsoft-delivered SMS and voice authentication into externally supplied exceptions.

Passkeys are credentials based on FIDO standards and public-key cryptography. When a passkey is created, a private key is stored on the user’s device while a corresponding public key is registered with the application or online service.

During authentication, the service sends a cryptographic challenge to the authenticator. After the user unlocks the credential, the authenticator signs the challenge with the private key. The service then verifies the response using the public key.

A passkey may be unlocked with a fingerprint, facial recognition, or device PIN. Users may instead authenticate with a FIDO2 physical security key that stores the credential.

When biometrics are used, the biometric template and matching process remain on the user’s device. Microsoft, Google, or another online service receives the cryptographic response rather than the user’s fingerprint or facial image.

Because each passkey is bound to the legitimate website or application for which it was created, it cannot simply be entered into a fraudulent site.

There is also no reusable password or verification code for an attacker to steal through phishing, credential stuffing, SIM swapping, or interception of a text message.

Microsoft Entra ID supports both synced and device-bound passkeys. Synced passkeys may be stored through services such as Apple’s iCloud Keychain or Google Password Manager and made available on the user’s other authorized devices.

Device-bound passkeys remain on a particular physical device. Microsoft’s examples include passkeys held in Microsoft Authenticator, Entra passkeys stored on Windows devices and FIDO2 hardware security keys.

Microsoft recommends FIDO2 security keys or Microsoft Authenticator passkeys for users with elevated privileges and for highly regulated environments where an organization may need greater assurance about the authenticator being used.

Synced passkeys are intended to offer a less costly and more convenient option for most of the workforce. They can move among devices associated with the same credential-management account, but they do not provide the device attestation available from supported device-bound authenticators.

Microsoft attributed the urgency partly to the growing use of AI to produce more persuasive and scalable phishing campaigns.

The company said its threat intelligence researchers have observed click-through rates as high as 54 percent for AI-enabled phishing campaigns, compared with about 12 percent for more traditional campaigns.

Microsoft also pointed to the increasing accessibility of SIM swapping and techniques used to bypass conventional multifactor authentication. Once an identity has been compromised, the company said, AI can help an attacker accelerate network discovery, privilege escalation, and movement into other systems.

Google’s update has a narrower scope. Google Credential Provider for Windows (GCPW) now supports FIDO2-compliant physical security keys as a second authentication factor at the Windows login screen. Users can also approve the second factor with a passkey stored on a nearby Bluetooth-connected mobile device.

GCPW allows an employee or student to sign in to a Windows 10 or Windows 11 device using the managed Google Account provided by an employer or school.

Organizations install and configure the software on managed computers, allowing Google Workspace accounts to be associated with existing or newly created Windows profiles.

Users can then access Google and other connected single sign-on applications without repeatedly entering their Google credentials.

The new capability adds a phishing-resistant option for administrators enforcing Google’s two-step verification requirements at the Windows login screen. It does not make a passkey the primary Windows credential or eliminate the password used for ordinary subsequent sign-ins.

Google’s documentation says users generally enter their Google Account password and complete two-step verification during the initial GCPW login. Afterward, they ordinarily select their Windows profile and enter their Windows password.

The full Google authentication process may be required again after a password change, session expiration or detection of suspicious account activity.

There is no user-controlled setting for the new security-key capability. Google began a gradual rollout on July 13 that could take as long as 15 days to become visible across Rapid Release and Scheduled Release domains. The feature is available to all Google Workspace customers.

Unlike Microsoft’s Entra announcement, Google is not making passkeys the default Windows authentication method or announcing the elimination of passwords and texted verification codes.

The update strengthens the second factor available through GCPW and extends phishing-resistant authentication to a Windows login workflow where physical FIDO2 keys had not previously been supported.

The announcements come as enterprise interest in passkeys continues to exceed actual deployment. A FIDO Alliance and HID survey of 500 information technology and cybersecurity decision makers in the U.S., Canada, Britain, France, and Germany found that 93 percent of their organizations were at some stage of passkey adoption.

Only 13 percent, however, had deployed passkeys at scale.

The study also found that 59 percent of organizations were managing at least three separate credential or authentication systems, while 58 percent said digital identity management had become more complicated during the previous two years.

Seventy percent reported at least one identity-related security incident.

Microsoft is attempting to close that gap through default enrollment prompts and the eventual withdrawal of its native SMS and voice delivery service.

Google is addressing a more specific obstacle by adding FIDO2 security keys and nearby-device passkeys to an established Windows authentication workflow.

Article Topics

biometric security key  |  biometrics  |  FIDO2  |  Google  |  Microsoft  |  Microsoft Entra  |  passkeys  |  passwordless authentication