Privacy and Security Enable or Disable Passkey Autofill Access for Apps in Windows 11

This tutorial will show you how to allow or deny if apps can enumerate passkeys for all users in Windows 11.

Passkeys provide a more secure and convenient method to logging into websites and apps compared to passwords. Unlike passwords, which users must remember and type, passkeys are stored as secrets on a device and can use a device's unlock mechanism (such as biometrics or a PIN). Passkeys can be used without the need for other sign-in challenges, making the authentication process faster, secure, and more convenient.

You can use passkeys with any applications or websites that support them, to create and sign in with Windows Hello. Once a passkey is created and saved with Windows Hello, you can use your device's biometrics or PIN to sign in. Alternatively, you can use a companion device (phone or tablet) to sign in.

You can choose if apps are able to enumerate (autofill) passkeys.

Starting with Windows 11 version 26H2, you can now configure the Let Windows apps autofill passkeys policy to enable or disable letting all apps autofill passkeys for all users.

References:

You must be signed in as an administrator to allow or deny passkey autofill access for all apps.

1 Open Settings (Win+I).

2 Click/tap on Privacy & security on the left side, and click/tap on Passkeys on the right side. (see screenshot below)



3 Under Allow passkey autofill, turn On (default) or Off Passkey autofill access for what you want. (see screenshot below)


4 You can now close Settings if you like.





1 Open Windows Terminal (Admin), and select either Windows PowerShell or Command Prompt.

2 Copy and paste the command below you want to use into Terminal (Admin), and press Enter to apply. (see screenshot below)

Turn on Passkey autofill access
SystemSettingsAdminFlows.exe SetCamSystemGlobal passkeysEnumeration 1

OR

Turn off Passkey autofill access
SystemSettingsAdminFlows.exe SetCamSystemGlobal passkeysEnumeration 0

The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.

All editions can use Option Four to configure the same policy.

1 Open the Local Group Policy Editor (gpedit.msc).

2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below step 3)


3 In the right pane of App Privacy in the Local Group Policy Editor, double click/tap on the Let Windows apps autofill passkeys policy to edit it. (see screenshot below)


4 Do step 5 (force enable), step 6 (disable), or step 7 (default) below for what you want.

This will prevent using Option One and Option Two.

This will prevent using Option One and Option Two.

This is the default setting to allow using Option One and Option Two.

8 You can now close the Local Group Policy Editor if you like.





1 Do step 2 (force enable), step 3 (disable), or step 4 (disable) below for what you want.

This will prevent using Option One and Option Two.

(Contents of REG file for reference)

This will prevent using Option One and Option Two.

(Contents of REG file for reference)

This is the default setting to allow using Option One and Option Two.

(Contents of REG file for reference)

5 Save the .reg file to your desktop.

6 If you have Smart App Control turned on, you will need to unblock the downloaded REG file.

7 Double click/tap on the downloaded .reg file to merge it.

8 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

9 You can now delete the downloaded .reg file if you like.


That's it,
Shawn Brink