Issue/Question
Why am I being prompted to create a passkey for my WKU account?
Environment
Cause
As of September 1, 2026, Microsoft began making passkeys the default authentication experience in Microsoft Entra ID as part of its transition toward phishing-resistant authentication.
As a result, you may see a Microsoft prompt asking you to create a passkey when signing in to your WKU Account.
Resolution
A passkey is a secure, phishing-resistant way to verify your identity without relying on a password or verification code. Passkeys use FIDO2 public-key cryptography and are tied to the legitimate website or service where they were created. This prevents a fraudulent website from capturing and reusing your passkey in the same way an attacker might steal a password or verification code.
When signing in, you unlock your passkey using a method supported by your device, such as a fingerprint, facial recognition, device PIN, or hardware security key. Your biometric information or device PIN is used only to unlock the passkey and is not sent to WKU or Microsoft.
Types of Passkeys
Microsoft Entra ID supports two primary types of passkeys:
Synced Passkeys
A synced passkey is stored using a supported credential manager and can be securely synchronized across compatible devices.
Examples include:
• Apple iCloud Keychain.
• Google Password Manager.
This can be convenient if you already use a supported credential manager across multiple personal devices.
Device-Bound Passkeys
A device-bound passkey is created and stored on a specific device and does not leave that device.
Examples include:
• Passkey in Microsoft Authenticator.
• Windows Hello.
• FIDO2 hardware security keys.
Because the passkey remains associated with the device where it was created, you may need another registered authentication method if that device is lost, replaced, or unavailable.