Does Microsoft Entra ID support passwordless authentication with passkeys and magic links for external customer-facing apps, or is it really only for employees?

“Yes. Microsoft Entra ID supports passwordless authentication for external, customer-facing applications.”

“Passkeys (FIDO2/WebAuthn) | Yes | Passwordless login using Face ID, Touch ID, Windows Hello, PIN or security key.”

“Email one-time passcode | Yes | Customer enters their email address and receives a code to sign in. No password required.”

“Google / Apple sign-in | Yes | Customers authenticate through an external identity provider.”

“Microsoft supports email one-time passcodes (OTP), but its standard customer identity user flows don't offer a native, configurable magic-link authentication method.”

“Customers must initially register using an email + password or username + password local account.”

“Microsoft does not provide an out-of-the-box passkey registration and management UI. You need to implement this in your application using the FIDO2 provisioning APIs.”

“Most importantly, passkeys currently don't work for customers who use email OTP as their primary sign-in method, or customers who authenticate through Google, Apple or other federated identity providers.”

“SMS OTP | Limited | Primarily available as an MFA method rather than a standard primary sign-in method.”