Set up your device-bound passkey
Step 1 of 10
Set up your passkey
This guide will help you use your Temporary Access Pass (TAP) to sign in to your new account and register a secure device-bound passkey using Microsoft Authenticator.
Microsoft Authenticator can be used as a passkey provider. Other passkey managers, such as Apple Passwords or Google Password Manager, work in a similar way - this guide focuses on Microsoft Authenticator.
You will need
- Your onboarding email
- Your new username
- Your Temporary Access Pass
- Your mobile phone
- Internet access
- A screen lock, PIN, fingerprint or Face ID set up on your phone
Approximate duration: no more than 5 minutes.
Privacy
Get Microsoft Authenticator
You can install the app now, or wait until we reach the install step later in this guide.
Can you sign in right now?
Gate 1: Are you a new user or an existing user?
Gate 2 (new user): Do you have a Temporary Access Pass (TAP)?
Gate 2 (existing user): How do you want to sign in?
Cannot continue yet
You need a Temporary Access Pass (TAP) to proceed with first-time setup. Contact support first.
Choose your phone
Select the type of phone you will use to set up Microsoft Authenticator.
This guide supports both iPhone and Android. The overall setup process is the same, but buttons, menu names and screens may look slightly different depending on your phone and operating-system version.
Set up your new account
You will use your Temporary Access Pass (TAP) and Microsoft Authenticator to register a device-bound passkey. This guide takes around five minutes.
Note
Install Microsoft Authenticator
Complete the action shown below on your phone.
- Open the Apple App Store.
- Search for Microsoft Authenticator.
- Confirm the publisher is Microsoft Corporation.
- Install and open the app.
Complete the action shown below on your phone.
- Open Google Play.
- Search for Microsoft Authenticator.
- Confirm the publisher is Microsoft Corporation.
- Install and open the app.
Note
Return to this guide when finished. Select Next to continue.
Enable Microsoft Authenticator as a passkey provider
Your phone may prompt you to enable Microsoft Authenticator as a provider for passkeys. The wording may mention passwords, autofill, credential providers or passkeys.
Note
Complete the action shown below on your phone.
- Follow the Microsoft Authenticator prompt to open Settings.
- Open the phone's Passwords or Password Options settings.
- Make sure password and passkey autofill is turned on.
- Enable Microsoft Authenticator as an available password/passkey provider.
- Return to Microsoft Authenticator.
The exact wording may vary depending on your iOS version. You do not need to remove an existing personal password manager unless you choose to.
iPhone screenshot to be added
Follow the written steps below until this image is added.
Complete the action shown below on your phone.
- Follow the Microsoft Authenticator prompt to open your phone's password, passkey, credential provider or autofill settings.
- Enable or select Microsoft Authenticator as a passkey provider.
- Return to Microsoft Authenticator.
The exact path varies between Samsung, Google Pixel and other Android phones. You do not need to remove your existing personal password manager.
Android screenshot to be added
Your screen may look different depending on the phone manufacturer and Android version.
Return to this guide when finished. Select Next to continue.
I did not see this prompt
Continue with the next step. Microsoft Authenticator may show the provider prompt later when the passkey is created. If setup fails, return to this step and check your phone's password, passkey or autofill provider settings.
Add your work account
Complete the actions shown below on your phone.
- Open Microsoft Authenticator.
- Select the plus (+) button.
- Select Work or school account.
- Select Sign in.
The plus button and menu layout may appear in a slightly different position on your phone.
Return to this guide when finished. Select Next to continue.
Sign in to continue setup
Complete the actions shown below on your phone.
Path A: Sign in with TAP
- Enter your username from your onboarding email.
- Select Next.
- Enter the Temporary Access Pass from your onboarding email.
- Select Sign in.
Path B: Sign in with existing MFA/passkey
- Enter your username from your onboarding email or work account details.
- Select Next.
- Select your existing MFA or passkey sign-in option.
- Complete approval and continue.
- Enter your username and continue.
- Use TAP for first-time setup, or your existing MFA/passkey if already configured.
- Complete sign-in and continue.
Important
- Do not enter your Temporary Access Pass into this onboarding website.
- Do not forward or share your Temporary Access Pass.
- The Temporary Access Pass is temporary and will expire.
- If it has expired, contact support.
The Microsoft sign-in screens should be broadly similar to those shown here.
Return to this guide when finished. Select Next to continue.
Create the passkey
After signing in, Microsoft Authenticator will guide you through securing the account and creating a passkey.
- Select Continue when asked to secure the account.
- Follow the Microsoft Authenticator prompts.
- Approve the use of Face ID, fingerprint or your phone PIN.
- Confirm that the passkey has been created.
- Return to this guide.
- Select Next.
Exact prompts vary by device manufacturer. You may be asked for your fingerprint, face recognition or device PIN.
Note
Return to this guide when finished. Select Next to continue.
Test the passkey
You can test your new passkey from a computer or another device.
- Open the Microsoft 365 sign-in page.
- Enter your username.
- Select Other ways to sign in.
- Select Face, fingerprint, PIN or security key.
- Select iPhone, iPad or Android device if prompted.
- A QR code appears.
- Scan the QR code using your phone.
- Select Sign in with passkey.
- Complete Face ID, fingerprint or PIN verification.
Use the normal iPhone Camera app to scan the QR code — not the Authenticator app's own scanner.
Use your phone camera, or the Android system QR-code prompt, to scan the code.
Trouble scanning the QR code?
- Bluetooth is turned on.
- Both devices have internet access.
- The QR code is still visible on screen.
- Your phone is unlocked.
- You are using the correct account.
Return to this guide when finished. Select Next to continue.
Your passkey is ready
Your Temporary Access Pass is no longer needed after successful setup. Future sign-ins use your passkey, protected by Face ID, fingerprint or your device PIN.
You can now access your Microsoft 365 applications:
Your device-bound passkey has been successfully configured.
You can now sign in using Microsoft Authenticator together with your fingerprint, face unlock or device PIN.
You no longer need to enter your Temporary Access Pass.
Troubleshooting
I did not see the passkey-provider prompt
iPhone: continue with the next step. The prompt may appear later, when the passkey is created. If needed, open the phone's Passwords or Password Options settings and confirm Microsoft Authenticator is enabled as a provider.
Android: continue with the next step. If setup fails, check your phone's password, passkey, credential provider or autofill settings and enable Microsoft Authenticator there.
iPhone screenshot to be added
Follow the written steps below until this image is added.
Android screenshot to be added
Your screen may look different depending on the phone manufacturer and Android version.
My Temporary Access Pass has expired
Contact your IT support team. This website cannot regenerate or collect a new Temporary Access Pass.
I entered the Temporary Access Pass but setup stopped
- Reopen Microsoft Authenticator.
- Select your work account.
- Look for Continue setup or Create a passkey.
- Restart this guide if required.
I selected the wrong account type
Return to the add-account step and select Work or school account.
I cannot scan the sign-in QR code
iPhone: use the normal Camera app.
Android: use your phone camera or the Android system QR-code flow.
- Turn on Bluetooth.
- Confirm both devices have internet access.
- Keep the QR code visible on screen.
- Unlock your phone.
My phone does not support passkeys
Device or operating-system compatibility may apply. Contact your IT support team for help.
I already use another password manager
Enabling Microsoft Authenticator as a passkey provider does not necessarily require removing or disabling another password or passkey manager. The behaviour depends on your phone and operating-system version.