Passkeys do not work with Microsoft 365

Thanks for the update wavesound!

1Password's watchtower falsely lists passkey availability on a few sites including Microsoft 365. It is available for Microsoft Personal accounts like outlook.com, hotmail.com, etc.

https://1password.community/discussion/140574/passkeys-do-not-work-with-microsoft-365

steph_giles

It works fine for Personal accounts with Microsoft (e.g. outlook.com or hotmail.com).

It does not work for Microsoft 365 Business accounts since Microsoft does not support Passkeys for those accounts at this time.

@dcoletta that is the correct area to add 2FA methods, but Microsoft haven't yet implemented support for Passkeys in Entra ID (formerly Azure AD). That's the system that Microsoft 365 uses for authentication.

Your admins have the option to enable 'Security Key' in the list, https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key#enable-fido2-security-key-method. But that does not enable the support for Passkeys.

I have not been able to setup a passkey with Microsoft either. It seems the only option is to use the MS Authenticator app.

Am I right that now Passkey only is available for personal Microsoft accounts and not for school and business accounts?
When I try to setup the passkey I will be redirected to: https://login.live.com/

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser: Not Provided

It seems like there ought to be a way to add a passkey in account settings, but I can’t find it, and Google’s no help. https://mysignins.microsoft.com/security-info is where I would expect to see the option, but it’s not there:

Hey @dcoletta,

You're right, at some point in the past, login.live.com and microsoftonline.com shared the same sign in credentials which has been added to our historical shared credentials list. This list combines login.live.com and microsoftonline.com under one domain so to speak, which explains why the Watchtower passkey banner is taking you to the incorrect page.

This is not the intended behaviour and I've gone ahead and raised this with our development team to investigate further, thank you for bringing this to our attention.

If you go directly to microsoftonline.com and sign in to your account, is there an option to add a passkey within your account settings?

ref: dev/core/core#24202

In 1Password, I see this for my entry for my work login to Microsoft 365:

But when I go through the “use passkey” flow, it takes me to a page whose URL starts with https://login.live.com/login.srf and when I try to log in, I get the error “That Microsoft account doesn't exist. Enter a different account or get a new one.”

That error is I believe due to the fact that there are different login URLs for Microsoft depending on whether it’s a home account or a work/school account.

I also notice that I only get offered the passkey option when microsoftonline.com is one of the websites listed for this login. So I’m guessing that it’s 1Password logic that is sending me to login.live.com, and I think it should be sending me to some other login page that works with a work/school account.

Is there a way I can tell 1Password to use the work/school login?

1Password Version: 8.10.16
Extension Version: 2.15.1
OS Version: macOS 13.6
Browser: Chrome

Hey @razeth,

I have taken a look at the internal issue and we are having some trouble reliably reproducing this one. Can you reproduce the issue and send over some additional details to help us with our investigation? Here's how: https://support.1password.com/cs/extension-console-log/.

Please attach the console log to an email message addressed to support+forum@1password.com with a link to this thread.

You should receive an automated reply from our BitBot assistant with a Support ID number. Please post that number here. Thanks very much!