Split passkey docs (4/5): FIDO2 security key (enable/register/sign-in) (#13776)

* Split passkey docs: FIDO2 security key (enable/register/sign-in)

Part 4 of 5 splitting PR #13648 (AB#568765). Adds the new Sign in with a security
key article and updates the security key enablement and registration how-tos, with
the corresponding TOC entry.

AB#568765

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove stale unreferenced passkey image

Remove passkey-profiles.png, which is not referenced by any article in this
branch or the final consolidated state.

AB#568765

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Copy-edit pass: fix hyphenation and refresh metadata

Run copy-edit skill (v1.0.13) with spell check on the FIDO2 security key
articles. Spell check found no misspellings. Hyphenate 'security key-based',
trim a trailing space in the H1, and refresh metadata.

AB#568765

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix broken bookmark to passkey enablement section

Update the cross-reference anchor from the removed
#configure-passkey-fido2-sign-in-in-the-microsoft-entra-admin-center to the
current #enable-passkey-profiles section in how-to-authentication-passkeys-fido2.md.

AB#568765

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Justinha

docs/identity/authentication/TOC.yml

@@ -198,6 +198,8 @@
         href: how-to-register-passkey-with-security-key.md
       - name: Enable security key sign-in to Windows
         href: howto-authentication-passwordless-security-key-windows.md
+      - name: Sign in with a security key
+        href: how-to-security-key-sign-in.md
       - name: SSO to on-premises resources
         href: howto-authentication-passwordless-security-key-on-premises.md
       - name: Hybrid FAQs

docs/identity/authentication/how-to-register-passkey-with-security-key.md

@@ -1,78 +1,66 @@
 ---
-title: Register a passkey (FIDO2) with a FIDO2 security key
-description: User registration of a passkey (FIDO2) with a FIDO2 security key.
-
-services: active-directory
+title: Register a passkey with a FIDO2 security key
+description: Learn how to register a passkey with a FIDO2 security key in Microsoft Entra ID. Use Security info or a prompted sign-in flow.
 ms.topic: how-to
-ms.date: 10/28/2025
+ms.date: 07/05/2026
 ms.reviewer: kimhana
 ms.collection: M365-identity-device-management
-# Customer intent: As an identity administrator, I want to understand... 
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1013
+# Customer intent: As an identity administrator, I want to understand how users register a passkey with a FIDO2 security key.
 
 ---
-# Register a passkey (FIDO2) with a FIDO2 security key
+# Register a passkey with a FIDO2 security key
+
+FIDO2 security keys are device-bound passkeys stored on a physical authenticator. The private key never leaves the security key, which provides strong protection against remote phishing attacks. Security keys are recommended for highly regulated industries or users with elevated privileges.
 
-This article shows how to register a passkey as an authentication method by using a FIDO2 security key. 
+This article shows how to register a passkey as an authentication method by using a FIDO2 security key. After registration, you can [sign in with the security key](how-to-security-key-sign-in.md).
 
 ## First-time registration
 
-1. First-time users need to register a passkey (FIDO2) as an authentication method by navigating and completing the process from a browser at [Security info](https://mysignins.microsoft.com/security-info).
-1. Tap **Add sign-in method** > **Choose a method** > **Passkey** > **Add**.
-1. Sign in with multifactor authentication (MFA) before adding a passkey (FIDO2), then tap **Next**.
+To register a passkey for the first time, open [Security info](https://mysignins.microsoft.com/security-info) in a web browser to complete the registration.
 
-   :::image type="content" border="true" source="media/how-to-register-passkey-with-security-key/add-passkey.png" alt-text="Screenshot of the Add a passkey (FIDO2) option in My Security info.":::
+1. Open a web browser and sign in to [Security info](https://mysignins.microsoft.com/security-info).
+1. Sign in with multifactor authentication (MFA).
+1. Tap **Add sign-in method** > **Choose a method** > **Passkey**.
+1. Tap **Next**.
 
 1. Select where you want to save your passkey (FIDO2). 
 
    > [!NOTE]
    > Options displayed vary depending on your browser and device operating system. If the device where you started the registration process supports passkeys (FIDO2), you'll be asked to save the passkey to that device. Select **Use another device** or **More options** to display additional ways for you to save the passkey. 
 
-   :::image type="content" border="true" source="media/how-to-register-passkey-with-security-key/choose-where-store-passkey.png" alt-text="Screenshot of the dialog where to save your passkey (FIDO2) in My Security info.":::
-
-1. (Optional) If you previously set up a passkey (FIDO2) on a mobile device and selected the option to remember that device for quicker sign-in, the device name may appear as a selectable option. In this case, do the following steps: 
+1. (Optional) If you previously set up a passkey (FIDO2) on a mobile device and selected the option to remember that device for quicker sign-in, the device name might appear as a selectable option. In this case, do the following steps:
 
    1. Choose **Security key**.
    1. Follow the prompts to connect your security key and provide a PIN or biometric method. 
-   1. Upon completion, you're redirected to the **My Security info** screen, where you can change the default name for the new sign-in method. 
+   1. After you complete these steps, you're redirected to the **My Security info** screen, where you can change the default name for the new sign-in method. 
    1. Select **Done** to finish registering the new method.
 
 ## Prompted registration
 
-1. If your organization requires you to register a passkey (FIDO2), you’ll be prompted after sign-in to add a passkey (FIDO2).
+If your organization requires you to register a passkey (FIDO2), you're prompted after sign-in.
 
-   :::image type="content" border="true" source="media/how-to-register-passkey-with-security-key/inline-registration.png" alt-text="Screenshot of the Add a passkey (FIDO2) option for a more secure sign-in in My Security info.":::
+1. When you see the prompt to add a passkey (FIDO2), tap **Next**.
 
-1. Tap **Next**, then you're directed to `login.microsoftonline.com`. 
-1. Select where you would like to save your passkey (FIDO2).
+1. You're directed to `login.microsoftonline.com`.
+1. Select where you want to save your passkey (FIDO2).
 
    > [!NOTE]
-   > Options displayed vary depending on your browser and device operating system. If the device where you started the registration process supports passkeys (FIDO2), you'll be asked to save the passkey (FIDO2) to that device. Select **Use another device** or **More options** displays additional ways for you to save the passkey. 
+   > Options displayed vary depending on your browser and device operating system. If the device where you started the registration process supports passkeys (FIDO2), you'll be asked to save the passkey (FIDO2) to that device. Select **Use another device** or **More options** to display additional ways for you to save the passkey. 
 
-   :::image type="content" border="true" source="media/how-to-register-passkey-with-security-key/choose-where-store-passkey.png" alt-text="Screenshot of the prompt where to store your passkey (FIDO2) in My Security info.":::
-
-1. (Optional) If you previously set up a passkey (FIDO2) on a mobile device and selected the option to remember that device for quicker sign-in, the device name may appear as a selectable option. In this case, do the following steps: 
+1. (Optional) If you previously set up a passkey (FIDO2) on a mobile device and selected the option to remember that device for quicker sign-in, the device name might appear as a selectable option. In this case, do the following steps:
 
    1. Choose **Security key**.
    1. Follow the prompts to connect your security key and provide a PIN or biometric method. 
-   1. Upon completion, you're redirected to the **My Security info** screen, where you can change the default name for the new sign-in method. 
+   1. After you complete these steps, you're redirected to the **My Security info** screen, where you can change the default name for the new sign-in method. 
    1. Select **Done** to finish registering the new method.
 
-## Sign-in with your new passkey (FIDO2)
-
-1. Navigate to `login.microsoftonline.com`.
-
-   :::image type="content" border="true" source="media/how-to-register-passkey-with-security-key/sign-in-microsoft.png" alt-text="Screenshot of the sign in to Microsoft prompt.":::
-
-1. Select **Sign-in options**.
-
-   :::image type="content" border="true" source="media/how-to-register-passkey-with-security-key/sign-in-options.png" alt-text="Screenshot of the sign in options for Microsoft.":::
-
-1. Choose **Face**, **Fingerprint**, **PIN**, or **Security key**.
-1. A security window opens. Follow the remaining prompts to sign-in with the method that you selected. 
-
-## Next steps
+## Related content
 
-- [Choosing authentication methods for your organization](concept-authentication-methods.md)
-- [Register security keys on behalf of users](how-to-authentication-passkeys-fido2.md)
+- [Sign in with a FIDO2 security key](how-to-security-key-sign-in.md)
+- [Register a synced passkey (FIDO2)](how-to-register-passkey.md)
+- [Enable passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-passkeys-fido2.md)
+- [Passkey FAQ](passkey-faq.yml)
 
 

docs/identity/authentication/how-to-security-key-sign-in.md

@@ -0,0 +1,58 @@
+---
+title: Sign in with a FIDO2 security key
+description: Learn how to sign in to Microsoft Entra ID with a FIDO2 security key. Sign in to web apps, Windows, and on-premises resources.
+ms.topic: how-to
+ms.date: 07/05/2026
+ms.reviewer: kimhana
+ms.collection: M365-identity-device-management
+ai-usage: ai-assisted
+ms.custom: msecd-doc-authoring-1013
+# Customer intent: As a user, I want to sign in to my work or school account by using a FIDO2 security key.
+---
+# Sign in with a FIDO2 security key
+
+FIDO2 security keys are device-bound passkeys stored on a physical authenticator. The private key never leaves the security key, which provides strong protection against remote phishing attacks. Security keys come in a variety of form factors (USB, NFC, Bluetooth) and are recommended for highly regulated industries or users with elevated privileges.
+
+For more information about the availability of passkey (FIDO2) authentication across native apps, web browsers, and operating systems, see [Support for FIDO2 authentication with Microsoft Entra ID](concept-fido2-compatibility.md).
+
+## Sign in with a security key
+
+1. Open your browser and go to the resource you're trying to access, such as [Office](https://www.office.com).
+
+1. You can enter your username and select **Next** to sign in. If you most recently used a passkey to sign in, you're automatically prompted to sign in with a passkey.
+
+   :::image type="content" source="media/how-to-sign-in-passkey/sign-in-options-name.png" alt-text="Screenshot that shows the Sign in page with a username and the Next button.":::
+
+   Or select **Sign-in options** >  **Face, fingerprint, PIN, or security key** to sign in without a username.
+
+   :::image type="content" source="media/how-to-sign-in-passkey/sign-in-options-passkey.png" alt-text="Screenshots that show the Sign-in options button and the Face, fingerprint, PIN or security key option.":::
+
+1. Select **Security key**.
+
+   :::image type="content" source="media/how-to-security-key-sign-in/choose-passkey-security-key.png" alt-text="Screenshot that shows the Choose a passkey dialog with Security key option." border="true" lightbox="media/how-to-security-key-sign-in/choose-passkey-security-key.png":::
+
+1. Your device opens a security window. Insert your FIDO2 security key if it's a USB key, or bring it near the reader if it's an NFC key.
+
+1. To verify your identity, scan your fingerprint or enter your PIN when prompted by the operating system or browser dialog.
+
+1. You're signed in with your work or school account.
+
+## Known issues
+
+### Orphaned passkey
+
+An orphaned passkey occurs when a passkey remains on a security key but is no longer registered with Microsoft Entra ID. This typically happens if the passkey was deleted from a user's Security info or removed due to policy changes, but the local credential wasn't cleaned up.
+
+If you're blocked from sign-in by an orphaned passkey:
+
+1. Remove the orphaned passkey from the security key by using the security key's management tool.
+1. Re-register a new passkey after cleanup.
+
+## Related content
+
+- [Register a passkey with a FIDO2 security key](how-to-register-passkey-with-security-key.md)
+- [Enable passkeys (FIDO2) in Microsoft Entra ID](how-to-authentication-passkeys-fido2.md)
+- [Enable security key sign-in to Windows](howto-authentication-passwordless-security-key-windows.md)
+- [SSO to on-premises resources](howto-authentication-passwordless-security-key-on-premises.md)
+- [Passkey FAQ](passkey-faq.yml)
+- [Support for FIDO2 authentication with Microsoft Entra ID](concept-fido2-compatibility.md)