Share via

Passkeys are first not used, then missing under Security

mark k 0 Reputation points
2025-10-23T19:15:52.4433333+00:00

Over the months of logging in/out of Microsoft accounts where the Passkey options would come up first. I would then select to use Password instead to login to the accounts, I decided to buy a Yubikey. I did not want to create passkeys in Windows 11 using Windows Hello security. I did not want to use Passkeys tied to one device and no back up option. After getting the Yubikey, I set up all my Microsoft accounts to log in using Passkeys. This has been working good over the months, until recently.

The past several Windows Updates that installed in Windows seems to have changed something, or Microsoft change the handling of creating and using Passkeys.

When I try to log in to various Microsoft accounts, I had to select the Security device option to log in using the Passkey. Prior to this, I would just click Security key, enter PIN, and touch Yubikey to authenticate in the accounts. Some of the accounts stopped prompting for the passkey or experienced an error when trying to log in with the passkey. When I logged in to these Microsoft accounts using the Password, I would go in to the Security settings and some would stills how the passkey there, or the passkey no longer existed. Either way, I would have to re-create these passkeys.

Did Microsoft recently change anything that would cause these passkeys to suddenly fail or get remove from these Microsoft accounts? I find this rather strange because Microsoft is pushing users to use passkeys.

My other non-Microsoft passkeys are still working and no problems, just the Microsoft passkeys are the problem. Just wondering if any TPM 2.0 updates ocurred to cause these problems.

Windows for home | Windows 11 | Security and privacy
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Craig Long 15,880 Reputation points Volunteer Moderator
    2025-10-23T19:35:21.3633333+00:00

    Is your security key listed under Security > Manage how I sign in > Ways to prove who you are in your Microsoft account?

    Is two-step verification enabled?

    User's image

  2. Craig Long 15,880 Reputation points Volunteer Moderator
    2025-10-23T20:21:38.1733333+00:00

    Maybe a policy change?:

    https://www.guidepointsecurity.com/blog/goodbye-legacy-mfa-new-microsoft-authentication-methods-policy/

    Quote:

    Microsoft has announced that on September 30, 2025 they will deprecate the legacy multifactor authentication (MFA) and self‑service password reset (SSPR) policies in Microsoft Entra ID. After this date, all authentication method management will move to the unified Authentication Methods policy.

  3. mark k 0 Reputation points
    2025-10-23T23:59:00.5966667+00:00

    Update:

    I had to delete the passkey in a Microsoft account because it would not allow the account to authenticate correctly. I logged in using the password method (password method seems so much more reliable).

    I added the Use an app method back where I set up Microsoft Authenticator app:

    User's image

    Once I authenticated through Microsoft Authenticator app, I wanted to set up my passkey again:

    User's image

    I still have two-step authentication enabled: User's image

    I selected the security key option again to set up the passkey:

    User's image

    I went through the steps to create a new passkey again:

    User's image

    I logged out of the Microsoft account. Cleared Microsoft Edge cache, etc. to make sure the account is not authenticated.

    When I logged in to the Microsoft account, this time, it worked exactly as it should. I entered the Microsoft account email address, then prompted to select the authentication method, I selected Security Key, and it prompted for the PIN of the security key, touched the Yubikey, and the account authenticated successsfully without any errors.

    To correct this problem on my other Microsoft accounts:

    • Remove any authenticator apps.
    • Remove any existing passkeys created prior to October 1, 2025. (Not sure if that is valid, but based on what I am seeing, prior passkeys do not always authenticate correctly).
    • Just make sure you have Password, Text a Code, and/or Email a code set up in Security.

    Log out of the account, clear all browsers cache, and log in to the account to set up the authentication in Microsoft Authenticator. After this is successfully set up for you, create your new passkey. I have my passkeys on a Yubikey and it works like it should now.

    Based on my experiences so far, Microsoft broke something and after re-setting up all the security methods again, the Microsoft accounts authenticate correctly now.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.