MFA: Set up a passkey in Microsoft Authenticator App

You can sign in to Authenticator to create a passkey in the app and get seamless single sign-on across Microsoft native apps. This flow is the recommended way to set up a passkey in Authenticator. If you're signed in or already have an account in Authenticator, you still need to complete these steps to add a passkey in Authenticator.

1. Download Authenticator from the App Store, and go through the privacy screens.

2. Add your account in Authenticator on your iOS device:

   If you installed Authenticator for the first time on your device, on the Secure Your Digital Life screen, tap Add work or school account.

   

   If you installed Authenticator on your device but you didn't add an account, tap Add account or the + button, and select Work or school account. Then tap Sign in.

   

   If you already added an account in Authenticator, tap your account, and then tap Create a passkey.

   

3. Complete multifactor authentication (MFA).

4. If necessary, tap Settings and set up a screen lock.

   

5. Tap Settings to enable Authenticator as a passkey provider.

   

6. On your iOS 18 device, go to Settings > General > Autofill & Passwords. On your iOS 17 device, go to Settings > Passwords > Password Options.

   On both operating systems, make sure that AutoFill Passwords and Passkeys is turned on. Under Autofill From, make sure that Authenticator is selected.

   

7. After you return to Authenticator, tap Done to confirm that you added Authenticator as a passkey provider. Then you can see Passkey added as a sign-in method for your account. Tap Done again to finish.

   

   Authenticator sets up passkey, passwordless, and MFA for sign-in according to your work or school account policies. Tap your account to see information, including your new passkey.

1. On the same iOS device as the Authenticator or by using another device, such as a laptop, open a web browser and sign in with MFA to Security info.

2. On Security info, tap + Add sign-in method and select Passkey in Microsoft Authenticator.

   

3. If you're asked to sign in with MFA, select Next.

4. If necessary, download Authenticator to your iOS device. You can select Microsoft Authenticator and scan a QR code to install Authenticator from the iOS App Store. After you download Authenticator, tap Next.

   

5. You're prompted to open the Authenticator app and create your passkey there. Open Authenticator and go through the privacy screens as needed.

   

6. Add your account in Authenticator on your iOS device.

   If you installed Authenticator for the first time on your device, on the Secure Your Digital Life screen, tap Add work or school account.

   

   If you installed Authenticator on your device before but didn't add an account, tap Add account or the + button, and select Work or school account. Then tap Sign in.

   

   If you already added an account in Authenticator, tap your account, and then tap Create a passkey.

   

7. Complete multifactor authentication (MFA).

8. If necessary, tap Settings and set up a screen lock.

   

9. Tap Settings to enable Authenticator as a passkey provider.

10. On your iOS 18 device, go to Settings > General > Autofill & Passwords. On your iOS 17 device, go to Settings > Passwords > Password Options.

    On both operating systems, make sure that AutoFill Passwords and Passkeys is turned on. Under Autofill From, make sure that Authenticator is selected.

    

11. After you return to Authenticator, tap Done to confirm that you added Authenticator as a passkey provider. Then you can see Passkey added as a sign-in method for your account. Tap Done again to finish.

    

    Authenticator sets up passkey, passwordless, and MFA for sign-in according to your work or school account policies.

12. Return to your browser after you finish the passkey setup in Authenticator, and select Next.

    

13. The wizard verifies that the passkey was created in Authenticator.

    

14. After the passkey is created, select Done.

    

15. On Security info, you can see the new passkey that was added.

    

To remove the passkey from Authenticator, tap the account name, and then tap Settings > Delete passkey. You also need to delete your passkey from Security info.

In some cases when you try to register a passkey, it gets stored locally in the Authenticator app but isn't registered on the authentication server. For example, the passkey provider might not be permitted or the connection might time out. If you try to register a passkey and see an error that the passkey already exists, delete the passkey that was created locally in Authenticator and retry registration.

You can sign in to Authenticator to create a passkey in the app and get seamless single sign-on across Microsoft native apps. This flow is the recommended way to set up a passkey in Authenticator. If you're signed in or already have an account in Authenticator, you still need to complete these steps to add a passkey in Authenticator.

1. Download Authenticator from Google Play, open it, and go through the privacy screens.

2. Add your account in Authenticator on your Android device:

   If you installed Authenticator for the first time on your device, on the Secure Your Digital Life screen, tap Add work or school account.

   

   If you installed Authenticator on your device but you didn't add an account, tap Add account or the + button, and select Work or school account. Then tap Sign in.

   

   If you already added an account in Authenticator, tap your account, and then tap Create a passkey.

   

3. Complete multifactor authentication (MFA).

4. If necessary, tap Settings and set up a screen lock.

   

5. Tap Settings to enable Authenticator as a passkey provider.

   Note
   The steps to enable passkey providers on Android might vary based on the make and model of your device. Search for Passkey on your device settings, or consult your device manufacturer for guidance. If your device runs Android 14 and you can't enable Authenticator as a passkey provider, we recommend that you upgrade to Android 15.

   

   1. Open Passwords & accounts.

      

   2. In the Additional providers section, make sure that Authenticator is selected.

      

6. After you return to Authenticator, tap Done to confirm that you added Authenticator as a passkey provider. Then you can see Passkey added as a sign-in method for your account. Tap Done again to finish.

   

Authenticator sets up passkey, passwordless, and MFA for sign-in according to your work or school account policies. Tap your account to see information, including your new passkey.

1. On the same Android device as the Authenticator or by using another device, such as a laptop, open a web browser and sign in with MFA to Security info.

2. On Security info, tap + Add sign-in method and select Passkey in Microsoft Authenticator.

   

3. If you're asked to sign in with MFA, select Next.

4. If necessary, download Authenticator to your Android device. You can select Microsoft Authenticator and scan a QR code to install Authenticator from Google Play. After you download Authenticator to your Android device, tap Next.

   

5. You're prompted to open the Authenticator app and create your passkey there.

   

6. Open Authenticator and go through the privacy screens as needed.

   • If you installed Authenticator for the first time on your device, on the Secure Your Digital Life screen, tap Add work or school account.

     

   • If you installed Authenticator on your device before but didn't add an account, tap Add account or the + button, and select Work or school account. Then tap Sign in.

     

   • If you already added an account in Authenticator, tap your account, and then tap Create a passkey.

     

7. Complete multifactor authentication (MFA).

8. If necessary, tap Settings and set up a screen lock.

   

9. Tap Settings to enable Authenticator as a passkey provider.

   Note
   The steps to enable passkey providers on Android might vary based on the make and model of your device. Search for Passkey on your device settings, or consult your device manufacturer for guidance. If your device runs Android 14 and you can't enable Authenticator as a passkey provider, we recommend that you upgrade to Android 15.

   

   1. Open Passwords & accounts.

      

   2. In the Additional providers section, make sure that Authenticator is selected.

      

10. After you return to Authenticator, tap Done to confirm that you added Authenticator as a passkey provider. Then you can see Passkey added as a sign-in method for your account. Tap Done again to finish.

    

    Authenticator sets up passkey, passwordless, and MFA for sign-in according to your work or school account policies.

11. After you finish the passkey setup in Authenticator, return to your browser where Security info is open. Select Next.

    

12. The wizard verifies that the passkey was created in Authenticator.

13. After the passkey is created, select Done.

    

14. On Security info, you can see the new passkey that was added.

    

To remove the passkey from Authenticator, tap the account name, tap Settings, and then tap Delete passkey.

In most cases, the passkey is also deleted from Security info. If not, go to Security info and select Delete to remove it.

In some cases when you try to register a passkey, it gets stored locally in the Authenticator app but isn't registered on the authentication server. For example, the passkey provider might not be permitted or the connection might time out. If you try to register a passkey and see an error that the passkey already exists, delete the passkey that was created locally in Authenticator and retry registration.