Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method
Table of Contents
No matching heading
Microsoft is removing a prerequisite for passkeys in Microsoft Entra. Message Center post MC1450133 (published August 7, 2026, timeline updated October 26, 2026) says users will be able to register a passkey as their first MFA method.
Until now, users had to register another MFA method or use a TAP (Temporary Access Pass) before they could add a passkey.
This requirement complicated certain deployment scenarios for IT teams. For example, when an organization wanted to prioritize Windows Hello for Business, a TAP was also required to enable provisioning, even though the goal was to minimize intermediate authentication methods.
Beyond the operational complexity, this step could also encourage users to rely on less secure methods, such as SMS or phone calls.
What is changing
- Users with only a password will be able to register a passkey directly.
- Eligible users will be prompted to register a passkey by default, including when registration is triggered by an MFA requirement or a Conditional Access authentication strength.
- Security Defaults will follow in January-February 2027.
Deployment timeline
| Phase | Covers | Rollout (Worldwide, GCC) |
|---|---|---|
| Phase 1 | Synced passkeys, Entra passkeys on Windows, FIDO2 security keys | Early November 2026 to early January 2027 |
| Phase 2 | Windows Hello for Business, macOS Platform SSO, passkeys and passwordless sign-in in Microsoft Authenticator | Early January 2027 to late February 2027 |
(The Message Center post writes General Availability (Worldwide, GCC): We will begin rolling out in early January 2026 and expect to complete by late February 2027[...] , this reads as a typo for 2027).
What to do
No action is required, but this is a good opportunity to:
- Review Conditional Access policies related to security information registration.
- Require MFA when registering security information if your organization wants an additional verification step.
- Update onboarding guides: users will be prompted to register a passkey by default.
Administrators keep control through the authentication methods policy and Conditional Access, which decide which methods users are allowed to register.
