Google Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default

Google started a gradual rollout on 13 July 2026, taking up to 15 days across Rapid Release and Scheduled Release domains, that adds FIDO2-compliant security keys as a second factor in the Windows login flow for Google Workspace users. It is available to all Workspace customers. The move lands within days of Microsoft confirming that from 1 September 2026 passkeys become the default authentication experience in Entra ID, with users on SMS or voice automatically enabled and prompted to register at their next multifactor prompt. Both vendors are pushing the same direction: away from passwords and one-time codes that can be intercepted, replayed, or handed to a convincing phishing page.

Why it matters

Workspace organisations running Windows fleets have lived with a split: strong FIDO2 authentication for Google services, and a local Windows password protecting the device those services are used from. Closing that gap matters more than the feature list suggests, because the desktop login is where credential theft and lateral movement usually start.

Read the two announcements together and the pattern is that phishing-resistant authentication is becoming the platform default rather than a project you fund. The remaining work moves to the tail: shared accounts, frontline staff without a managed device, contractors, and recovery paths that quietly depend on a phone number.

Plan the enrolment window carefully, because attackers already target passkey registration by voice phishing. Our enterprise passkey guide sequences it.

Source: Biometric Update