Known Issue: GlobalProtect VPN Does Not Fully Support Passkey Authentication

Some users may experience authentication issues when signing in to the GlobalProtect VPN after switching from SMS multi-factor authentication (MFA) to a passkey.

At this time, the GlobalProtect VPN authentication flow does not fully support passkeys for MFA. As a result, users may be unable to complete the sign-in process when a passkey is their only available authentication method. As a workaround to regain access to GlobalProtect VPN, users can add Microsoft Authenticator push notifications as an additional authentication method on their account.

Symptoms

When attempting to connect to GlobalProtect VPN:

  1. You enter your University of Windsor credentials.
  2. The Microsoft sign-in page appears.
  3. The option to authenticate using your registered passkey is not presented.
  4. Instead, you may see a prompt asking you to insert a USB security key. This occurs even if you have never registered a USB security key on your account.
  5. Selecting alternative options often returns you to the same prompt, resulting in an authentication loop and preventing access to the VPN.

Cause

GlobalProtect VPN currently does not properly handle passkey-based authentication during the Microsoft Entra sign-in process.

When SMS authentication has been removed from your account after registering a passkey, the VPN client may not offer a supported MFA method to complete the sign-in, causing authentication to fail.

Resolution

To regain access to GlobalProtect VPN, add Microsoft Authenticator push notifications as an authentication method on your account.

Microsoft Authenticator push notifications are fully supported by the GlobalProtect VPN authentication flow and can be used as a replacement for SMS-based MFA.

How to Add Microsoft Authenticator

  1. Install the Microsoft Authenticator app on your mobile device form the app store.
  2. Launch the app and sign in using your Microsoft work/school account.
  3. Follow the on-screen instructions to complete registration.
  4. Verify that Microsoft Authenticator appears in your list of authentication methods of your Microsoft work/school account at myprofile.microsof.com

After Microsoft Authenticator has been added, try connecting to GlobalProtect VPN again. You should receive a push notification on your mobile device that can be used to complete MFA and establish the VPN connection.

Important Notes

  • Your passkey remains registered and can continue to be used for supported Microsoft sign-in scenarios.
  • The issue is specific to the current GlobalProtect VPN authentication experience.
  • You do not need to register a USB security key unless you intend to use one.
  • If you are repeatedly asked to insert a USB security key that you do not own, this is a known symptom of the issue described in this article.
  • Microsoft Authenticator push notifications are the recommended workaround until passkey support becomes available in the GlobalProtect VPN sign-in flow.

Need Help?

If you continue to experience problems connecting to GlobalProtect VPN after adding Microsoft Authenticator, please contact the IT Service Desk and provide:

  • A screenshot of the authentication prompt.
  • The date and time of your attempted VPN connection.
  • A description of the authentication method(s) registered on your account.
Print Article

Related Articles (1)

Known Issue: Unable to use a passkey to sign-in
Passkeys stored on a mobile device can only be used for cross-device authentication when Bluetooth communication between the computer and the mobile device is available. On shared or public computers where Bluetooth is disabled, unavailable, or restricted, users should use Microsoft Authenticator push notifications or another registered authentication method to complete MFA.