Passkeys: What they are and how to create them

What are Passkeys?

Traditionally, you sign in by providing both of the following:

1. Password
2. Multifactor authentication (MFA) such as a text, authenticator app code, or phone call

Passkeys are a more secure alternative. They replace both the password and MFA code with a sign-in credential stored on a trusted device, security key, or approved password manager, unlocked using a PIN, fingerprint, or facial recognition.

How to create Passkeys for your diocesan Microsoft Account

• Create a Passkey on Windows with Windows Hello >
• Create a Passkey on a Mobile with the Microsoft Authenticator app >
• Create a Passkey on Mac with iCloud Keychain >

🪟Create a Microsoft 365 Passkey on a Windows Computer with Windows Hello

For diocesan Windows computers, you can setup PIN and facial / fingerprint recognition by going to:

1. ⚙️Settings
2. Accounts
3. Sign-in options

📱Create a Microsoft 365 Passkey on a Mobile with the Microsoft Authenticator app

1. Ensure you have setup a PIN code and, optionally, facial and/or fingerprint recognition on your mobile in the device settings.
2. Personal mobiles: Download the Microsoft Authenticator app from the Apple App Store or Google Play Store
   1. For diocesan mobiles, this app is already installed. Go to step 3.
3. Open the Microsoft Authenticator app
4. If your diocesan account is already listed, go to step 5. Otherwise:
   1. Tap Add account or select the + plus icon top right
   2. Choose Work or school account
   3. Sign in with your diocesan credentials
5. Select your diocesan account
6. Select Create a passkey
   1. If you see Passkey rather than Create a passkey then a passkey has already been created for this account. Skip to step 8.
7. Authenticate your account again to create a passkey
8. Ensure the Microsoft Authenticator app can manage your passkeys on your device:
   1. For iPhone/iPad (iOS)
      1. Open Settings
      2. Go to Passwords > Password Options
         1. or General > Autofill & Passwords on older versions
      3. Turn on AutoFill Passwords and Passkeys.
      4. Select Microsoft Authenticator as the default provider.
   2. For Android
      1. Open Settings
      2. Go to Passwords & passkeys
         1. or Passwords & accounts
         2. or System > Autofill service
      3. Under Additional providers, ensure Microsoft Authenticator is enabled.
9. When signing in on your mobile device, the Microsoft Authenticator app will popup and you will authenticate using a PIN code, fingerprint or facial recognition.
10. When signing in on another device, you may see a QR code. Scan the QR code with your mobile's camera and follow the steps on the mobile to sign in.

🍎Create a Microsoft 365 Passkey on a Mac Computer with iCloud Keychain

1. Go to https://mysignins.microsoft.com/security-info >
   1. It is recommended you use the Microsoft Edge web browser
2. Sign in with your diocesan credentials
3. Select Add sign-in method
4. Select Passkey
5. Select Next x2
6. If asked for a security key, select Save another way
7. When asked where to store the passkey, choose iCloud Keychain / Passwords
   1. Turn on iCloud Keychain if asked
8. Authenticate with Touch ID or your Mac password
9. Give your passkey a name, eg. Diocesan Mac