|
| 1 | +--- |
| 2 | +title: Sign in to Microsoft Entra Connect Sync by using passwordless authentication |
| 3 | +description: Learn how to sign in to Microsoft Entra Connect Sync by using passwordless authentication methods such as FIDO2 security keys and passkeys. |
| 4 | +author: omondiatieno |
| 5 | +ms.author: jomondi |
| 6 | +ms.service: entra-id |
| 7 | +ms.subservice: hybrid-connect |
| 8 | +ms.topic: how-to |
| 9 | +ms.custom: msecd-doc-authoring-1013 |
| 10 | +ms.date: 06/15/2026 |
| 11 | +ai-usage: ai-assisted |
| 12 | + |
| 13 | +#customer intent: As a hybrid identity administrator, I want to sign in to Microsoft Entra Connect Sync by using passwordless authentication so that I can install and configure synchronization without using a password. |
| 14 | + |
| 15 | +--- |
| 16 | + |
| 17 | +<!-- TODO: Confirm whether passwordless authentication for Microsoft Entra Connect Sync is in public preview. If it is, add the standard preview note or [!INCLUDE] near the top of the article. --> |
| 18 | +<!-- TODO: Confirm the minimum Microsoft Entra Connect Sync version that supports passwordless authentication, and add it to the prerequisites. --> |
| 19 | + |
| 20 | +# Sign in to Microsoft Entra Connect Sync by using passwordless authentication |
| 21 | + |
| 22 | +Passwordless authentication for Microsoft Entra Connect Sync lets administrators sign in with secure, modern credentials (such as FIDO2 security keys, passkeys, or Windows Hello) instead of typing a password. |
| 23 | + |
| 24 | +This article shows you how to enable passwordless authentication methods in Microsoft Entra ID, register a credential, turn on passwordless sign-in for Microsoft Entra Connect Sync, and verify that you can sign in without a password. You can choose from the following passwordless methods: |
| 25 | + |
| 26 | +- **FIDO2 security keys**: Insert a USB or NFC key (for example, a YubiKey), enter a PIN, and tap the key. |
| 27 | +- **Passkeys**: Use a platform-stored credential (for example, an iCloud Keychain or Android passkey) through the system browser or a device prompt. |
| 28 | + |
| 29 | +## Prerequisites |
| 30 | + |
| 31 | +- A Microsoft Entra account with the **Hybrid Administrator** or **Global Administrator** role. |
| 32 | +- A FIDO2 security key, such as a YubiKey. |
| 33 | +- Windows Server 2022 or later. |
| 34 | + |
| 35 | +## Enable passwordless authentication methods in Microsoft Entra ID |
| 36 | + |
| 37 | +Before you can register a passwordless credential, enable the passkey or FIDO2 authentication method for your account in Microsoft Entra ID. |
| 38 | + |
| 39 | +1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). |
| 40 | +1. Browse to **Entra ID** > **Authentication methods** > **Policies**. |
| 41 | +1. Select **Passkey (FIDO2)**. |
| 42 | +1. Set the method to **Enabled**, and target **All users** or a specific group that contains your administrator account. |
| 43 | + |
| 44 | + :::image type="content" source="media/how-to-connect-passwordless-authentication/authentication-methods-policies.png" alt-text="Screenshot of the Authentication methods Policies page in the Microsoft Entra admin center with Passkey (FIDO2) enabled for all users." lightbox="media/how-to-connect-passwordless-authentication/authentication-methods-policies.png"::: |
| 45 | + |
| 46 | +## Register a passwordless credential |
| 47 | + |
| 48 | +After the authentication method is enabled, register the credential that you want to use to sign in. You can register a passkey, a security key, or both. |
| 49 | + |
| 50 | +### Register a passkey |
| 51 | + |
| 52 | +Register a passkey that's stored on your device or password manager: |
| 53 | + |
| 54 | +1. Go to [Security info](https://mysignins.microsoft.com/security-info) and sign in with your administrator account. |
| 55 | +1. Select **Add sign-in method**. |
| 56 | +1. Select **Passkey**. |
| 57 | +1. Follow the prompts to create the passkey with your device, such as Windows Hello, Face ID, Touch ID, or a synced password manager. |
| 58 | + |
| 59 | +After registration finishes, the new passkey appears under your registered sign-in methods. |
| 60 | + |
| 61 | +### Register a security key |
| 62 | + |
| 63 | +Register your FIDO2 security key, such as a YubiKey: |
| 64 | + |
| 65 | +1. Go to [Security info](https://mysignins.microsoft.com/security-info) and sign in with your administrator account. |
| 66 | +1. Select **Add sign-in method**. |
| 67 | +1. Select **Security key**. |
| 68 | +1. Select **USB device**. |
| 69 | +1. Insert your YubiKey, and then touch it when it blinks. |
| 70 | +1. Set a PIN if you're prompted, and then touch the key again to finish registration. |
| 71 | + |
| 72 | +## Turn on passwordless authentication for Microsoft Entra Connect Sync |
| 73 | + |
| 74 | +To make passwordless sign-in available in the installation wizard, install Microsoft Entra Connect Sync and set a registry key. |
| 75 | + |
| 76 | +1. Install Microsoft Entra Connect Sync. For installation steps, see [Get started with Microsoft Entra Connect Sync by using express settings](how-to-connect-install-express.md). |
| 77 | +1. On the server, open PowerShell and run the following command to enable passwordless authentication: |
| 78 | + |
| 79 | + ```powershell |
| 80 | + # Enable passwordless authentication |
| 81 | + New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Azure AD Connect" -Name "EnablePasswordlessAuth" -Value 1 -PropertyType DWORD -Force |
| 82 | + ``` |
| 83 | + |
| 84 | +## Sign in to Microsoft Entra Connect Sync without a password |
| 85 | + |
| 86 | +After passwordless authentication is enabled, use your passkey or security key to sign in when you run the installer. |
| 87 | + |
| 88 | +1. Run the Microsoft Entra Connect Sync installer. When you're prompted to sign in to Microsoft Entra ID, select **Sign-in options**. |
| 89 | + |
| 90 | + :::image type="content" source="media/how-to-connect-passwordless-authentication/sign-in-options.png" alt-text="Screenshot of the Microsoft sign-in window with Sign-in options available below the sign-in dialog." lightbox="media/how-to-connect-passwordless-authentication/sign-in-options.png"::: |
| 91 | + |
| 92 | +1. Select **Face, fingerprint, PIN or security key**, and then complete the prompt with the passkey or security key that you registered. |
| 93 | + |
| 94 | + :::image type="content" source="media/how-to-connect-passwordless-authentication/face-fingerprint-pin-security-key.png" alt-text="Screenshot of the Sign-in options screen with Face, fingerprint, PIN or security key selected." lightbox="media/how-to-connect-passwordless-authentication/face-fingerprint-pin-security-key.png"::: |
| 95 | + |
| 96 | +When sign-in succeeds, you're signed in to Microsoft Entra Connect Sync without entering a password. The same steps apply whether you sign in with a passkey or a security key. |
| 97 | + |
| 98 | +## Disable passwordless authentication |
| 99 | + |
| 100 | +To turn off passwordless authentication and return to signing in with a username and password, set the registry value to `0`. |
| 101 | + |
| 102 | +1. On the server, open PowerShell and run the following command to disable passwordless authentication: |
| 103 | + |
| 104 | + ```powershell |
| 105 | + # Disable passwordless authentication |
| 106 | + Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Azure AD Connect" -Name "EnablePasswordlessAuth" -Value 0 |
| 107 | + ``` |
| 108 | + |
| 109 | +1. Run the Microsoft Entra Connect Sync installer again. The passwordless sign-in option is no longer available, and you can sign in with your username and password. |
| 110 | + |
| 111 | +## Related content |
| 112 | + |
| 113 | +- [Get started with Microsoft Entra Connect Sync by using express settings](how-to-connect-install-express.md) |
| 114 | +- [Choose the right authentication method for your Microsoft Entra hybrid identity solution](choose-ad-authn.md) |
0 commit comments