In Diablo IV, the Skill Tree system gives players the ability to pick a skill and choose an upgrade to get stronger. Now, that tree has evolved to support more player choices. These new branches don’t just make skills stronger – they make them different. “If you’re newer to Diablo IV, the system is more approachable than it looks. Click a node, try it out, and see how it grows. For the more veteran adventurers, theorycrafting just got deeper,” writes Blizzard’s Chelsea Leah. Find out more about this at Xbox Wire.

Passkeys are designed to replace passwords with strong, phishing-resistant credentials that make sign-in quick, easy, and secure. With Microsoft Password Manager, users can now save and sync passkeys across devices signed in with their Microsoft account. Syncing passkeys enables a seamless sign-in experience, allowing users to access their credentials wherever they are signed in. Instead of being tied to a single device, passkeys can be securely available across devices while continuing to leverage device-based authentication such as biometrics or PIN. However, enabling this experience requires a thoughtful approach to security. Roaming cryptographic credentials must be protected during creation, sync, and recovery without weakening their security properties. In this post, we'll walk through the architectural principles that power passkey syncing in Microsoft Password Manager.

Architecture overview

Passkey syncing in Microsoft Password Manager is built on a layered architecture that's designed to securely enable roaming credentials. The system applies multiple independent protections across the boundaries between compute (where sensitive operations are processed), key management, storage, and device authorization. At a high level, passkey syncing in Microsoft Password Manager combines:

• Confidential computing for sensitive passkey operations.
• Hardware-rooted key protection for service-side encryption keys.
• Tamper-evident recovery storage for secure activation and recovery.
• Encrypted synchronization across registered devices.

These layers work together to protect passkeys during creation, synchronization, and recovery. The passkey service backend is deployed using Confidential Containers on Azure Container Instances (ACI), which leverage Trusted Execution Environments for protected execution of sensitive workloads.

Confidential compute for passkey operations

Sensitive passkey operations, including credential creation, assertion, and recovery validation, execute inside the Azure confidential computing environments backed by hardware isolation. This ensures that:

• Cryptographic material is processed inside protected memory.
• The host environment cannot inspect sensitive cryptographic material (such as passkeys and encryption keys) while in use.
• Only attested service code can access protected encryption keys.

By strictly controlling where passkey material can be decrypted and used, we ensure that sensitive cryptographic material remains protected within trusted execution boundaries, while strengthening operational integrity. Access to these operations is further gated by user verification using platform authenticators (for example, Windows Hello or device biometrics), with device-bound cryptographic keys used to authorize passkey operations.

Hardware-rooted key protection

Encryption keys that safeguard synced passkeys are protected using Azure Managed HSM. Access to these keys is restricted through attestation-based secure key release mechanisms. Before keys are released, the execution environment is verified using Microsoft Azure Attestation, ensuring that key material is only accessible within trusted confidential workloads and is not released to non-confidential environments. This provides a hardware-rooted trust anchor for service-side encryption operations. Passkeys are encrypted before synchronization and handled within authorized, hardware-isolated environments.

Secure registration and recovery

Microsoft Password Manager enables cross-device activation through a secure, auditable registration and recovery process. This process requires authentication via a user-defined knowledge factor (PIN), with all protections enforced within confidential computing boundaries. Recovery operations are validated within the confidential computing environment to ensure strong integrity guarantees. Recovery attempts are enforced using a securely maintained retry counter and associated recovery metadata, both recorded in a tamper-evident Azure Confidential Ledger. This prevents counter manipulation and rollback attempts. To protect against malicious brute-force attempts on the low-entropy PIN, the system enforces a fixed limit on consecutive incorrect attempts. Once this limit is reached, the system enters a lockout state. Recovery from lockout requires resetting the PIN through a secure flow that is initiated from a trusted device and authenticated via the user's Microsoft account. This design ensures that recovery mechanisms do not weaken the protections applied to synced passkeys.

Building for the passwordless future

Passkeys represent a major step forward in authentication. In Microsoft Password Manager, we've engineered a sync system that balances strong security protections with seamless cross-device usability. By combining confidential computing, hardware-backed key protection, and device-bound authorization, Microsoft Password Manager delivers secure passkey roaming built to withstand modern threats. These protections are designed as independent layers that collectively safeguard passkeys throughout their lifecycle. Synced passkeys are a strong step forward in our passwordless journey, bringing the simplicity and security of phishing-resistant sign-in to users. We're excited to continue this journey with new capabilities and experiences ahead.

IT practitioners don’t hand out praise easily. So when a solution architect, a head of workplace design and a modern workplace product manager start saying the same thing about an endpoint — simpler to manage, faster to deploy, easier to secure — it's worth paying attention to. Windows 365 Link turns one year old this month. To understand why it matters, it helps to understand the service it is purpose-built for: Windows 365 is a cloud service that streams a full Windows experience — your apps, your settings, your desktop — directly from the Microsoft Cloud to any device. Your PC, essentially, lives in the cloud. Windows 365 Link was built to take that idea further, giving organizations a simple-to-manage, secure endpoint for Windows 365 with no local data, no local apps and no local admin users, so they could scale Cloud PCs simply, securely and cost-effectively. In the year since its launch, it has expanded to new regions and found a home across industries as different as manufacturing, healthcare, retail and professional services. Windows 365 Link is helping a set of organizations with genuinely different challenges — an energy company looking to eliminate the management overhead that comes with running different devices for different roles; a global packaging manufacturer trying to give hundreds of factory workers seamless access to resources as they move station to station; a New Zealand telco rebuilding its entire desktop environment after separating from its parent company; and a Japanese IT infrastructure service provider developing a robust hybrid work foundation that balances convenience with security. What they found in Windows 365 Link wasn’t just a device; it was a way to stop reconciling complexity and start running IT the way it should work. Across organizations, the feedback tells a consistent story: https://youtu.be/KRymSGLgNOg Our growing partner network helps organizations quickly procure and deploy Windows 365 Link. We’ve onboarded more than 200 resellers across 20 countries. Feedback from partners with experience deploying Windows 365 Link highlights Windows 365 Link’s ability to simplify endpoint management and deliver reliable experiences:  https://youtu.be/3NUTul4a0gU Based on customer feedback, we make  regular updates to Windows 365 Link devices to further enhance user experience and streamline IT management. Key updates targeted for release this quarter include:

• Support for pairing Bluetooth® devices during the out-of-box experience, so you can use a wireless keyboard and mouse to set up the device

• Support for tenant branding including setting a custom wallpaper, logo and name on the sign-in screen, so you can provide a tailored experience for your users

• Support for unique peripherals via USB redirection with no endpoint configuration required (GA) and ability to configure specific USB devices via centralized IT Admin controls (Public Preview)

• Support for visibility into pending updates directly on the sign-in screen and ctrl+alt+del screen, so users know when updates are available

Support for tenant branding on the Windows 365 Link sign-in screen As we mark this milestone, we thank our Windows 365 customers and partners for their trust and collaboration. If you’re planning a device refresh for frontline or desk-based workers, consider Windows 365 Link as a more secure, simple-to-manage and cost-effective alternative to traditional desktops. For more on the potential benefits of deploying Windows 365 Link in shared spaces, read the Forrester Consulting study New Technology: The Projected Total Economic Impact™ of Windows 365 Link, July 2025, commissioned by Microsoft. We’re committed to expanding Windows 365 Link’s availability so more organizations can benefit from the power, simplicity and security of Windows 365.