Re-purposing Window-hello cred

Windows Hello for Business cannot currently be repurposed as a same-account Microsoft Entra passkey; either allow Windows Hello for Business in the Conditional Access authentication strength or register a separate FIDO2 authenticator when the resource strictly requires FIDO2.

If the objective is phishing-resistant MFA

Use the built-in Phishing-resistant MFA strength, which accepts all of these methods:

• Windows Hello for Business or platform credential
• FIDO2 security key/passkey
• Multifactor certificate-based authentication

This avoids requiring duplicate credentials merely to achieve phishing resistance. Conditional Access requires Microsoft Entra ID P1 and an account authorized to manage Conditional Access policies.^1^

In the Microsoft Entra admin center:

1. Open Entra ID → Protection → Conditional Access → Policies.
2. Open the applicable policy or create a pilot policy.
3. Under Grant, select Require authentication strength.
4. Select Phishing-resistant MFA strength.
5. Target a test group first and validate both WHfB and passkey sign-ins before expanding the scope.

Do not select both Require multifactor authentication and Require authentication strength in the same policy; that combination is unsupported.^1^

If a user initially authenticates by password, Entra might not subsequently offer WHfB to satisfy a strength that requires it. The user must restart the session and choose Sign-in options → Windows Hello as the primary method.^1^

If the policy must require FIDO2 specifically

A custom strength restricted to FIDO2 will not accept the existing WHfB credential as though it were a passkey. Register a separate authenticator, such as a FIDO2 security key or another supported passkey provider:

1. Open My Sign-ins → Security info.
2. Authenticate with MFA.
3. Select Add sign-in method → Choose a method → Passkey → Next.
4. At the storage prompt, select Use another device or More options, then select the security key or other supported authenticator.
5. Complete registration and verify that the method appears in Security info.^2^

This is the supported route when the application genuinely needs a WebAuthn/FIDO2 ceremony rather than the broader phishing-resistant assurance level.

Why the Windows Hello container does not solve this

Microsoft Entra passkey on Windows and WHfB can use the same local Windows Hello container, but they remain different credential types:

• A Windows passkey is a user-initiated, device-bound FIDO2 credential.
• WHfB is tied to device trust and is used for device sign-in and SSO.
• A Windows passkey does not support Windows device sign-in.
• If a WHfB credential already exists for the same account and container, registering a Windows passkey for that account can fail as already registered.^3^

For Windows-hosted passkeys generally, an Authentication Policy Administrator must enable Passkey (FIDO2), create a device-bound profile allowing the Windows Hello AAGUIDs, leave Enforce attestation disabled, and target the relevant users. That configuration enables Windows passkeys but does not bypass the same-account WHfB restriction.^3^

Comparison with macOS Platform SSO

The macOS capability is platform-specific. A Platform Credential backed by the Secure Enclave can be used as a phishing-resistant credential in supported WebAuthn challenges, including browser reauthentication.^4^ Its Platform SSO flow also uses the Secure Enclave-protected key to sign assertions for obtaining a PRT; Entra validates that proof and issues the PRT—the key itself is not converted into a PRT.^5^

Windows does not currently expose the corresponding same-account WHfB credential as a Microsoft Entra FIDO2 passkey through tenant configuration. Support cannot enable that behavior with a policy switch; it requires a Windows/Entra product change. Submit it through the official Microsoft Entra feedback or enterprise support channel, including:

• Affected Windows versions and join state
• The strict FIDO2-only Conditional Access definition
• The failed same-account registration flow
• The desired WebAuthn behavior
• The macOS Platform SSO comparison
• Whether accepting the built-in phishing-resistant strength meets the security requirement

References

1. Conditional Access authentication strengths
2. Register a Microsoft Entra passkey on Windows
3. Enable Microsoft Entra passkey on Windows
4. macOS Platform Single Sign-on overview
5. Architecture and authentication flow for macOS Platform SSO with Microsoft Entra ID