Passwordless cryptographic credentials stored on a security key, on the device, or in Microsoft Authenticator. They are bound to the legitimate site, so they don't work on a fake site: they are phishing-resistant.
In SC-900 they are grouped with Windows Hello for Business and certificate-based authentication as phishing-resistant methods. Since September 1, 2026, passkeys have been the default method in Microsoft Entra ID.
Passkeys (FIDO2) is a concept that can show up on the exam. Check the full guide to see it in context.