Parallels Passkeys: Testing Cross Device Authentication on Windows 11 VM on a Mac

When developing passkey authentication, one of the key components is testing cross-device authentication (CDA) via QR code. While the operating system handles the core functionality, various dialogs and additional steps might be required, such as prompting users to create a local passkey after completing cross-device authentication. These differences result in variations in the flow that must be tested. The most important test flow is Android / iPhone -> Windows. Of course, final testing should be carried out with real Windows 11 devices but during development, Parallels Virtualization is often used on a macOS devices.

Parallels passkey CDA testing on Mac

How does Cross-Device Authentication (CDA) via passkeys work when testing on Parallels, specifically on a Windows 11 virtual machine running on a Mac?

Let’s find out how this can be done, because at the moment the Parallels implementation does not work with passkey CDA.

Before you begin Cross-Device Authentication (CDA) with passkeys on a Windows 11 / Parallels running on a Mac, you'll need to set up the environment properly. Here's a step-by-step guide to getting started:

If you haven't already installed Windows 11 on Parallels, you'll need to do so. Note that installing Windows 10 is no longer feasible due to the lack of ARM builds. Parallels only supports Windows 11 on Macs with Apple Silicon (M1/M2). Windows 11 is automatically available in case you have a license accessible.

Using the macOS Bluetooth Adapter does not work. Therefore, to test CDA via passkeys, an external Bluetooth 5.0 adapter is necessary, as Parallels cannot use the Mac's built-in Bluetooth for this functionality. Here's what you need:

• Adapter: Purchase a standard USB Bluetooth adapter, such as the ASUS USB-BT500.
• USB to USB-C Adapter: Since most USB Bluetooth adapters do not support USB-C, you'll need a USB to USB-C adapter to connect it to your Mac.

Follow these steps to set up the Bluetooth adapter for use with the Windows 11 VM:

1. Plug in the Bluetooth Adapter: Insert the Bluetooth adapter into the USB-C adapter and then plug it into your Mac.
2. Allow Connection: When macOS prompts you, allow the connection to the external Bluetooth device.
3. Assign the Adapter to the VM:
   • Open Parallels. Then, navigate to Parallels Desktop Preferences.

• In the Preferences window, assign the Bluetooth adapter to the Windows 11 VM to ensure it is always available when the VM is running.

4. Restart the Windows 11 VM: After assigning the adapter, restart the VM so it can properly detect and install the necessary drivers for the adapter.

The first time the Windows VM tries to access the Bluetooth adapter, macOS might prompt you to confirm this action. Be sure to allow the access so that the Bluetooth adapter can work correctly within the VM and click “Always Allow”:

Once these steps are completed, your Windows 11 VM will be equipped to perform the Bluetooth-based cross-device authentication necessary for passkey testing.

If you want to quickly check if your CDA Authentication works go ahead and use the Passkeys Debugger.

1. Take out your mobile phone and navigate to https://www.passkeys-debugger.io. Create a passkey with default settings:

2. Open your Windows 11 Chrome with an Incognito tab, and switch from Passkey Creation to Passkey Login Tab and hit Start Passkey Login

3. Choose “iPhone, iPad or Android device”

4. Once you scan the QR code you will see that the devices are connected

5. On your mobile device, you will be able to select the created passkey

6. Once the passkey ceremony is completed, you can see the results in the passkey debugger. Here is the link to our test.

As you can see below, the authenticatorAttachment is set to cross-platform, we successfully completed a CDA on our Windows 11 VM.

Testing Cross-Device Authentication (CDA) with passkeys on a Windows 11 virtual machine running on Parallels is possible, but it requires some additional hardware setup. While Parallels provides a good environment for platform authenticator testing, the CDA process will not work out-of-the-box due to the limitations of the Mac’s built-in Bluetooth. So the question

How does Cross-Device Authentication (CDA) via passkeys work when testing on Parallels, specifically on a Windows 11 virtual machine running on a Mac?

was answered in the blog post.

To enable Cross-Device Authentication (CDA) via passkeys on a Windows 11 VM in Parallels, an external USB Bluetooth adapter is essential. Parallels cannot leverage the Mac's internal Bluetooth functionality for this purpose, so using a Bluetooth adapter (such as the ASUS USB-BT500) is the critical step to get everything working.

By following the setup instructions for the adapter and testing the passkey flows, you can successfully complete CDA within a Windows 11 VM, confirming the system’s ability to handle cross-device authentication. From our experience it is especially important to test also Windows 10 environments, at the moment this is reliably only possible with real Windows 10 systems.

Special thanks to Christopher Harrell for pointing us to the the right solution within FIDO Alliance.