Recent Windows Updates Cause Microsoft Security Keys to Prompt for PIN

Microsoft has confirmed that recent Windows 11 updates are causing a change in how FIDO2 security keys function during authentication.

Users who previously signed in without a PIN may now be required to create one when using their security key, even if a PIN was not set during initial registration.

What Changed

After installing the September 29, 2025, preview update (KB5065789) or later updates, Windows 11 users may encounter a new PIN creation prompt when authenticating with a FIDO2 security key.

This behavior occurs specifically when a Relying Party (RP) or Identity Provider (IDP) requests “User Verification = Preferred” during the authentication flow with a security key that does not already have a PIN configured.

The change began rolling out gradually following the September 29, 2025, preview update and was completed across all Windows 11 clients after the November 11, 2025, security update (KB5068861).

Microsoft has stated this is intended behavior, not a bug. The update was implemented to ensure Windows remains compliant with WebAuthn specifications set by the World Wide Web Consortium (W3C).

The technical explanation involves how user verification settings work in the WebAuthn authentication flow.

When a service sets “userVerification” to “preferred” in the PublicKeyCredentialRequestOptions, Windows will now prompt users to set up a PIN if one has not been configured on their security key.

User Verification confirms that the person using a security key is present and authorized to do so, typically through a PIN or biometric scan. There are three settings that services can choose from:

Preferred means the service wants user verification if the authenticator supports it. Under the new update, this triggers PIN setup if none exists. Required mandates user verification for authentication to proceed.

Discouraged indicates the service does not want user verification. In this case, no PIN setup is prompted if one is not already configured.

Organizations and individuals using FIDO2 security keys for passwordless authentication will notice this change when accessing services that request the “preferred” user verification setting.

This includes many enterprise applications, cloud services, and websites that have adopted FIDO2 authentication.

The update brings consistency to how PIN setup works across both registration and authentication workflows.

Previously, users might have registered a security key without a PIN and continued using it without one. Now, Windows actively prompts for PIN creation during authentication if the service requests it.

Users encountering this PIN prompt should follow the on-screen instructions to create a PIN for their security key. This is a one-time setup that enhances security by adding a verification layer.

IT administrators should communicate this change to their organizations, as help desk inquiries may increase from users unfamiliar with the new prompt. The change affects Windows 11 devices running version 24H2 and version 25H2.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.