Skip to content
OSOMCO
Menu
Contact

Microsoft Entra now prompts eligible users for passkeys on its own

Published · Updated · OSOMCO

Service
CY
Our take
Act
Takes effect

Microsoft changed the Microsoft Entra registration campaign to push passkeys, the phishing-resistant way to sign in. If your campaign is set to Microsoft managed, Entra can start prompting your users to register a passkey at sign-in, without anyone in IT turning it on.

What changes

  • Users who can register a passkey get a simpler registration flow.
  • In Microsoft managed mode, Entra checks each user’s passkey profile at sign-in. If the profile qualifies, it prompts the user to register a passkey.
  • In Enabled mode, profiles are not checked: every in-scope user allowed to use passkeys can be prompted.
  • The campaign does not override your policies: it only asks for passkeys your authentication methods policy already allows.

A passkey profile qualifies if it has no restrictions, allows only synced or only device-bound passkeys with no key restrictions, has an allow list that includes iCloud Keychain, Google Password Manager, Microsoft Authenticator or Entra passkey on Windows, or enforces attestation.

When

Rollout started in early September 2026 and Microsoft expected to finish by mid-September, worldwide and in GCC. By November it should already be live in your tenant.

Who it affects

  • IT teams that manage Entra ID and its authentication methods.
  • Users in scope of the registration campaign, who may see a prompt to register a passkey.

What to do

  1. Check which state your registration campaign is in (Microsoft managed, Enabled or Disabled).
  2. Review which users and groups are in scope and which passkey profile each one has.
  3. If you don’t want Microsoft to decide who gets prompted, change the campaign state and pick the methods yourself.
  4. Confirm your authentication methods policy enables passkeys only for the right people.
  5. Tell your help desk and users before they see the prompt, so they don’t mistake it for phishing.

Handled well, this change is an opportunity: passkeys shut the door on password theft and most phishing.

Let’s review your Entra setup together.

Microsoft notice: MC1469555, “Microsoft Entra: Optimized passkey registration campaign experience”.

  • entra
  • passkeys
  • identity