Skip to content

Cookbook: Microsoft Entra ID Integration

This cookbook takes a Microsoft Entra ID tenant from no passkeys to people signing in with Crayonic wallets, on the web and on Windows. It lists what to check first, what to change in Entra ID and on your machines, and how to prove that each part works before you roll it out.

For: Entra ID and Windows administrators. You need: one test user, one test Windows machine and one Crayonic wallet of each model you plan to deploy.

Where this fits

This cookbook covers Options 1 and 2 of the Solution Architecture. Entra ID checks the passkey, so no Crayonic server is needed unless you choose to add Crayonic Credential Manager (CCM). For smart card (PIV certificate) sign-in without Entra ID, see the On-Premises Active Directory cookbook.

Microsoft's portal changes often

The Microsoft steps were checked against Microsoft Learn on 1 November 2026. If a menu has moved, follow the matching link under Sources.

Choose your setup

Make these three decisions first. They decide which steps you can skip.

Decision Options Go to
Who puts the passkey on the wallet? The user, on Microsoft's Security info page. Needs no Crayonic server. Step 4A
An administrator or helpdesk, or users with approvals, through CCM. Step 4B
How are your Windows machines joined? Microsoft Entra joined, or Microsoft Entra hybrid joined. Machines joined only to on-premises Active Directory cannot use this sign-in: use the On-Premises Active Directory cookbook instead. Step 6
Should people sign in by bringing the wallet to the machine? Yes: add a Crayonic Bridge and the Crayonic Agent on each machine. No: connect the wallet by USB or NFC. Step 6.4

The checklist

Keep this list open as you work. Each line links to its step.

Before you change anything

In Entra ID

On the wallets

On Windows

Before you roll out

1. Check the prerequisites

Licences and admin roles

Passkeys (FIDO2) work in every Entra ID edition, including Free. You need Microsoft Entra ID P1 only if you want to require passkeys with Conditional Access (step 8). Intune is optional.

Task Role you need
Change the Passkey (FIDO2) and Temporary Access Pass policies Authentication Policy Administrator
Create a Temporary Access Pass, or manage a user's passkeys Authentication Administrator. For users who hold admin roles: Privileged Authentication Administrator
Create Conditional Access policies Conditional Access Administrator
Create the Microsoft Entra Kerberos server object Hybrid Identity Administrator, plus an Active Directory account in Domain Admins and Enterprise Admins
Consent to CCM's Microsoft Graph permissions (CCM only) Global Administrator or Privileged Role Administrator

Machines

Requirement Microsoft Entra joined Microsoft Entra hybrid joined
Windows Windows 10 version 1909 or later, or Windows 11 Windows 10 version 2004 or later, or Windows 11
Domain controllers Only for on-premises resources Fully patched, Windows Server 2016 or later, with at least one writable domain controller per site
Microsoft Entra Kerberos Only for on-premises resources Required
Network The logon screen must be able to reach Microsoft Entra ID The same

Windows Hello for Business is not required: Microsoft states that security key sign-in does not depend on it.

Wallets

  • Update the firmware. Use the Crayonic Firmware Manager or the files on the Downloads page.
  • Set a PIN and enrol a fingerprint on the wallet. Entra ID requires user verification at every passkey sign-in, so a wallet with neither cannot register a passkey. The PIN has 4 to 8 digits and is entered on the wallet.

Emergency accounts and a pilot group

  • Keep at least two emergency access accounts that do not depend on passkeys and are excluded from every policy in this cookbook. They are your way back in if a policy locks people out.
  • Create a pilot security group, for example Crayonic-Pilot, with your test user in it. All the policies below target this group first.

2. Enable passkeys for the pilot group

Sign in to the Microsoft Entra admin center as an Authentication Policy Administrator.

Open the policy and turn on passkey profiles

  1. Go to Entra ID > Authentication methods > Policies and select Passkey (FIDO2).
  2. If a banner offers passkey profiles, select its link to opt in. Your current settings move to a Default passkey profile.

You cannot opt out

Once you turn on passkey profiles, you cannot turn them off. A tenant can have up to three profiles, including the default one.

Allow users to register

On the Configure tab, set Allow self-service set up to Yes. If it is No, users cannot register on the Security info page, even when the method is enabled.

Create a profile for your wallets

  1. Select + Add passkey profile and name it, for example Crayonic wallets.
  2. Use the pilot settings below and select Save.
Setting During the pilot In production (step 7)
Passkey types Device-bound Device-bound
Enforce attestation No Your choice: Yes checks at registration that the wallet is a genuine, listed model
Target specific AAGUIDs Off Your choice: on, with Behavior set to Allow and your wallets' AAGUIDs listed

Turn it on for the pilot group

  1. Select Enable and target and make sure Enable is On.
  2. Select Add target, then Select targets, and choose your pilot group.
  3. Assign the Crayonic wallets profile to the group and select Save.

Note

A user who is in an excluded group cannot register or use a passkey at all, even if another group includes them.

3. Enable Temporary Access Pass

A Temporary Access Pass (TAP) is a short-lived code that lets a new user sign in and register a passkey without any other strong sign-in method. Microsoft asks for recent multifactor authentication before registration, so a TAP is the easiest way to onboard someone who has none yet.

  1. Go to Entra ID > Authentication methods > Policies and select Temporary Access Pass.
  2. Select Enable and include your pilot group.
  3. Select Configure and review the settings. The defaults are a one-hour default lifetime, a range of one to eight hours and an eight-character code.
  4. Select Save.

To create a pass for a user, go to Entra ID > Users, select the user, then Authentication methods > Add authentication method > Temporary Access Pass. Note the code before you select OK, because it is not shown again.

Check your registration policies

Users in scope for the self-service password reset registration policy, or for the ID Protection multifactor authentication registration policy, are sent to a registration screen that does not support FIDO2 after signing in with a TAP. Take pilot users out of those policies if they get stuck there.

4. Put a passkey on the wallet

Choose 4A or 4B. They can be used side by side in one tenant.

4A. The user registers on the Security info page

Use Windows with Chrome or Edge, and connect the wallet by USB cable. This is the most reliable combination. See Limits for platforms where registration does not work.

  1. Connect the wallet and unlock it.
  2. Open Security info and sign in with multifactor authentication or a TAP.
  3. Select Add sign-in method > Choose a method > Passkey, then Next.
  4. When asked where to save the passkey, select Security key. If you do not see it, select Use another device or More options first.
  5. Confirm on the wallet with a fingerprint or the PIN.
  6. Give the passkey a name that identifies the wallet, such as Badge 01234, and select Done.

Finish promptly

Microsoft requires multifactor authentication within the last five minutes before registering. After signing in with a one-time TAP, the user has 10 minutes to complete registration.

4B. Provision through Crayonic Credential Manager

Use CCM when an administrator or helpdesk should provision wallets, or when users should request a passkey and have it approved. CCM needs the following set up once:

  1. Deploy CCM on-premises or in your cloud. See CCM Deployment. For isolated networks, see Entra-isolation mode, where the Graph steps below are done differently.
  2. Register the backend app. In the Microsoft Entra admin center, go to Entra ID > App registrations > New registration.

  3. Add permissions. Under API permissions, add these Microsoft Graph Application permissions, then select Grant admin consent:

    Permission Needed for
    UserAuthenticationMethod.ReadWrite.All Reading, creating and deleting passkeys
    User.Read.All User search and dashboard statistics
    Directory.Read.All Detecting admin roles
    User.ReadWrite.All Creating users from CCM. Add it only if you use that feature

  4. Connect CCM. In CCM, open Admin > Graph API and enter the Tenant ID, Client ID and Client Secret. Keep production secrets in the backend's environment or a secret store, as CCM Graph permissions describes.

  5. Install the Crayonic Agent on each workstation where wallets are provisioned. If you serve CCM from your own address, add it to the Agent's allowlist.

Then, to provision a wallet:

  1. Sign in to CCM with an account holding Authentication Administrator or Global Administrator, and connect the wallet to the workstation.
  2. Find the user and select the Key Icon (View Passkeys).
  3. Select Create Passkey and confirm on the wallet.
  4. Check that the new passkey shows green checkmarks for Wallet, Entra and CCM.

To let users request their own passkeys, or to require approvers, turn on Self-Service Configuration in the Admin User Manual. It is off by default.

Note

Microsoft labels its API for provisioning security keys on behalf of users as preview. Try this flow in your tenant before you depend on it.

5. Test web sign-in and read the AAGUID

Prove that the passkey works before you touch Windows.

  1. Open a private browser window and go to myaccount.microsoft.com.
  2. Choose to sign in with a security key, and confirm on the wallet.
  3. In the Microsoft Entra admin center, go to Entra ID > Users, select the test user, then Authentication methods.
  4. Open the passkey's details and note its AAGUID. Do this once for each wallet model you deploy.

An AAGUID identifies a wallet's model, not one individual wallet. Entra ID's list of FIDO2 keys eligible for attestation names one Crayonic model:

Listed as AAGUID
Crayonic KeyVault K1 (USB-NFC-BLE FIDO2 Authenticator) be727034-574a-f799-5c76-0929e0430973

The Crayonic Badge reports the same AAGUID, so Entra ID shows a Badge under the KeyVault K1 name. Use the value you read in step 4 for each model rather than assuming it, and name passkeys clearly so you can tell wallets apart.

6. Enable Windows sign-in

6.1 Confirm each machine's join state

Run this on the machine and read the two values:

dsregcmd /status
AzureAdJoined DomainJoined The machine is What to do
YES NO Microsoft Entra joined Do 6.2. Do 6.3 only if users need on-premises resources
YES YES Microsoft Entra hybrid joined Do 6.2 and 6.3. Both are required
NO YES Joined to Active Directory only Not supported. Set up hybrid join, or use smart card sign-in
NO NO Not joined Join it to Microsoft Entra ID. Connecting a work account only registers the device, which is not enough

6.2 Turn on security key sign-in

Use the one method that fits how you manage the machines.

Intune, specific groups. Use this for pilots and for machines that are already set up.

  1. In the Intune admin center, go to Devices > Windows > Configuration profiles > Create profile.
  2. Set Platform to Windows 10 and later and Profile type to Templates > Custom.
  3. Add a row with these values, then assign the profile to your pilot machines:
    • OMA-URI: ./Device/Vendor/MSFT/PassportForWork/SecurityKey/UseSecurityKeyForSignin
    • Data type: Integer
    • Value: 1

Intune, all new devices. In the Intune admin center, go to Devices > Enroll Devices > Windows enrollment > Windows Hello for Business and set Use security keys for sign-in to Enabled. This does not change machines that are already provisioned. Use the targeted method for those.

Group Policy (hybrid joined machines only). Set Computer Configuration > Administrative Templates > System > Logon > Turn on security key sign-in to Enabled. This needs the updated CredentialProviders.admx template, available from Windows 10 20H1.

Provisioning package. For machines outside Intune:

  1. In Windows Configuration Designer, create a project with the Provisioning package workflow for All Windows desktop editions.
  2. Under Runtime settings > WindowsHelloForBusiness > SecurityKeys, set UseSecurityKeyForSignIn to Enabled.
  3. Export the package and apply the .ppkg and .cat files to the machines.

6.3 Set up Microsoft Entra Kerberos

Do this for hybrid joined machines, and for Entra joined machines whose users need on-premises resources such as file shares. Entra ID can then issue Kerberos tickets for your Active Directory domain.

Check first

  • Domain controllers run Windows Server 2016 or later, fully patched
  • AES256_HMAC_SHA1 is allowed, if your domain controllers restrict Kerberos encryption types
  • Microsoft Entra Connect syncs onPremisesSamAccountName, onPremisesDomainName and onPremisesSecurityIdentifier. It does by default

Create the Kerberos server object

Run this as administrator on the Microsoft Entra Connect server, once for each domain that contains Entra users. It creates an object in Active Directory and publishes it to Entra ID.

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
Install-Module -Name AzureADHybridAuthenticationManagement -AllowClobber

$domain = $env:USERDNSDOMAIN
$userPrincipalName = "admin@contoso.onmicrosoft.com"   # a Hybrid Identity Administrator
$domainCred = Get-Credential                           # in Domain Admins and Enterprise Admins

Set-AzureADKerberosServer -Domain $domain -UserPrincipalName $userPrincipalName -DomainCredential $domainCred

Verify it

Get-AzureADKerberosServer -Domain $domain -UserPrincipalName $userPrincipalName -DomainCredential $domainCred

Enter the domain credential in user@domain format. In the output, ID must match CloudId, and KeyVersion must match CloudKeyVersion.

Rotate the key with Microsoft's tool only

Rotate this key on the same schedule as your other krbtgt keys, using Set-AzureADKerberosServer with -RotateServerKey. Other tools do not update both Active Directory and Entra ID.

6.4 Add the Crayonic Bridge and Agent (optional)

Without a Bridge, the user connects the wallet by USB or NFC and uses Windows' own security key option.

With a Crayonic Bridge and the Crayonic Agent, the sign-in screen shows a tile for each nearby badge. Follow Badge Sign-in Setup and apply the Entra FIDO preset. Its Setup tab checks the Entra join, the Windows version and the Bridge's FIDO interface for you.

With the preset, a user signs in like this:

  1. The user selects the badge's tile and holds the badge close to the Bridge.
  2. The sign-in starts by itself, and the user confirms on the badge with a fingerprint or the PIN.
  3. When the badge leaves the Bridge, the Agent locks the computer (Walk-away lock).

7. Run the acceptance tests

Run these with your test user on each wallet model and each type of machine.

  • Register: the passkey appears on the user's Authentication methods page in Entra ID
  • Web sign-in: myaccount.microsoft.com signs in with the wallet
  • Microsoft 365: an app such as Outlook on the web opens without a further password prompt
  • Windows sign-in: the machine signs in from the lock screen with the wallet
  • Windows unlock: a locked session unlocks with the wallet
  • On-premises resource (if you did 6.3): a file share opens without a prompt
  • Walk-away (if you did 6.4): removing the badge from the Bridge locks the machine
  • Wrong person: a wrong PIN or an unknown finger on the wallet does not sign in
  • Sign-in logs: in Entra ID > Monitoring & health > Sign-in logs, the sign-in shows a passkey as the method
  • Recovery: the lost wallet procedure works, and a second wallet can be registered with a TAP

Tighten the profile for production

When the tests pass, you can limit which wallets can be registered. Edit the Crayonic wallets profile, then repeat the registration test with a new passkey.

  • Enforce attestation: Yes. Entra ID checks the wallet's make and model against trusted metadata when a passkey is registered. Passkeys registered earlier without attestation keep working.
  • Target specific AAGUIDs: on, Behavior: Allow. Add the AAGUIDs you noted in step 5.

AAGUID lists can lock people out

Unlike attestation, key restrictions apply at sign-in as well as at registration. If you remove an AAGUID from the list, users with that wallet model can no longer sign in. Only change the list with a tested profile and a recovery plan.

Finally, go to Enable and target and move the profile from the pilot group to your production groups, in stages.

8. Enforce passkeys with Conditional Access (optional)

This needs Microsoft Entra ID P1. Enforce only after users have registered, or you will lock them out.

  1. Sign in as a Conditional Access Administrator and go to Entra ID > Conditional Access > Policies > New policy.
  2. Under Users, include your target group and exclude your emergency accounts.
  3. Under Target resources, choose the apps to protect. Start with one sensitive app.
  4. Under Grant, select Require authentication strength, then Phishing-resistant MFA strength. Do not combine this with Require multifactor authentication in the same policy.
  5. Set Enable policy to Report-only and review the sign-in logs for at least a few days.
  6. Change it to On when nobody who should have access would be blocked.

To allow only Crayonic wallets on a resource, go to Entra ID > Authentication methods > Authentication strengths > New authentication strength, select Passkeys (FIDO2), then Advanced options > Add AAGUID. Use that strength in the policy instead.

What enforcement does not do

Conditional Access is evaluated after the first sign-in step. A user can still type a password, but then has to use a passkey to continue. It does not remove the password from the account.

9. Operate

When Do this
A wallet is lost or stolen In Entra ID, go to the user's Authentication methods and delete the passkey (Passkey (device-bound) > Delete), or remove it in CCM. Then create a TAP and register a replacement wallet.
A wallet is reset or reassigned A factory reset removes the passkey from the wallet only. Also delete it from the previous user's Entra account.
A user's UPN changes Passkeys cannot follow the change. The user deletes the old passkey on Security info and registers a new one.
A password expires (hybrid) Passkey sign-in is blocked until the password is reset.
A user leaves Disable the account and delete their passkeys, then reset the wallet before reuse.
Firmware needs updating Use Crayonic Device Manager for fleets or the Firmware Manager for single machines.

Limits

Not supported by Microsoft with a security key

  • Machines joined only to on-premises Active Directory, and purely on-premises environments
  • Signing in to Windows Server
  • Remote Desktop, VDI and Citrix, unless WebAuthn redirection is used
  • Run as and S/MIME
  • Guest users registering a passkey
  • Some older admin PowerShell modules that sign in through Internet Explorer components

For these cases, consider a PIV certificate on the same wallet.

Other platforms

  • Registering a passkey does not work on iOS or ChromeOS, and can fail in macOS browsers. Register on Windows.
  • Bluetooth security keys are not supported for Entra ID sign-in on macOS, iOS, Android or ChromeOS. On Android and iOS, signing in with a Crayonic wallet over Bluetooth works only with a supported app that integrates the Crayonic SDK, not in a browser.
  • NFC security keys are not supported on macOS or ChromeOS.
  • Native apps on Android need Android 13 or later for sign-in with a security key.
  • A Crayonic Bridge presents the wallet as a USB security key to the computer, so the Bluetooth limits above apply to a direct wallet connection, not to the Bridge.

Troubleshooting

What you see Likely cause and fix
Passkey is not offered on Security info The user is outside the policy target, or Allow self-service set up is No. See step 2.
A TAP is not offered at sign-in The user is outside the TAP policy, the pass has expired or been used, or the change has not replicated yet. Wait a few minutes.
Temporary Access Pass sign in was blocked due to User Credential Policy The user is outside the policy, the one-time pass was already used, or a multi-use pass exists while the policy requires one-time use.
After a TAP, the user is sent to a registration screen with no passkey option The user is in a password reset or ID Protection registration policy. See the warning in step 3.
Registration is refused with attestation on The wallet's model isn't accepted. Test with Enforce attestation off and compare its AAGUID with step 5.
A wallet that used to work is suddenly refused Its AAGUID was removed from the profile, or device-bound passkeys were turned off for the group.
No security key option on the Windows sign-in screen Step 6.2 has not reached the machine. On a newly installed hybrid machine, sign in once with a password and wait for policy to sync.
Windows signs in, but a file share asks for credentials Check Kerberos (step 6.3). Run nltest /dsgetdc:contoso /keylist /kdc, with your domain name, to see whether a domain controller is responding.
Set-AzureADKerberosServer fails with Failed to read secrets Temporarily turn off the FIPS policy, run the command, then turn the policy back on. Check that the account has default administrative permissions.
No badge tile, or the badge does not connect See Badge Sign-in Setup, Troubleshooting. The preset connects a badge only when it is held close to the Bridge.

Sources

Microsoft Learn

Crayonic