Posted inMicrosoft Entra

MC1450133: Microsoft Entra ID Adds Passkey and Passwordless Sign-In as First Multifactor Authentication Method

5 minutesPosted inMicrosoft Entra
MWPRO IMPACT SCORE
OPERATIONAL IMPACT
57
0 25 50 75 100
HIGH IMPACT • REVIEW RECOMMENDED
Recommended Action:
Review the update and plan any required actions before rollout.
▶ What is MWPro Impact Score? Watch our 60‑second explainer

Primary Audience

Tenant AdminsMicrosoft 365 AdminsSecurity TeamsCompliance TeamsAzure AdminsIT ManagersService Owners
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
The rollout timeline has shifted slightly, now starting in early November 2026 instead of late October. This change affects how users register their first multifactor authentication method, enabling direct adoption of passkeys or passwordless options. Admins need to review Conditional Access and authentication method policies to ensure appropriate controls remain in place. User experience will change moderately as registration prompts and workflows align with passkey-first enrolment.
65
🛡️ Admin Impact
HIGH
45
👥 User Impact
MEDIUM
55
⚡ Urgency
HIGH
50
🔧 Effort
HIGH
ℹ️ WHAT YOU NEED TO KNOW
📌

AT A GLANCE

Users can now register a passkey or passwordless sign-in as their first MFA method, helping move to stronger and phishing-resistant authentication faster.
👥

END USERS

Users may be prompted to register a passkey or passwordless sign-in instead of SMS or voice during MFA setup.
🛡️

IT ADMINS

Review authentication method and Conditional Access policies and update registration guidance if needed before rollout.
📅

ROLLOUT TIMELINE

Start:
November 2026

📢 Official Microsoft Message Center Announcement

Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method
Message ID: MC1450133 (Updated)

Updated October 26, 2026: We have updated the timeline. Thank you for your patience. 

[What and why]

Users will soon be able to register a passkey as their first multifactor authentication method. Previously, people had to set up an alternate MFA method like SMS or Voice before they could add a passkey (FIDO2), Windows Hello for Business, macOS Platform SSO. That extra step pushed users toward weaker methods and slowed the move to phishing-resistant sign-in. Now password-only users can go straight to a passkey, making it easier to adopt strong authentication from day one. As part of this work, we will also be enabling Authenticator App passwordless sign-in to be a user’s first registered MFA method. 

[Rollout schedule]

This feature will roll out in phases: 

Phase 1: Support for synced passkeys, Microsoft Entra passkeys on Windows, and FIDO2 security keys.  

General Availability (Worldwide, GCC): We will begin rolling out in early November 2026 (previously late October) and expect to complete by early January 2027 (previously late November 2026). 

Phase 2: Support for Windows Hello for Business, macOS Platform SSO, Authenticator App passkey, and Authenticator App passwordless sign-in. 

General Availability (Worldwide, GCC): We will begin rolling out in early January 2026 and expect to complete by late February 2027. 

[Impact on your organization]

Who is affected

  • Users who have not yet registered a multifactor authentication method
  • Identity and security administrators responsible for authentication onboarding and registration policies

Platforms and services

  • Microsoft Entra ID
  • Passkeys (FIDO2)
  • Windows Hello for Business
  • macOS Platform SSO
  • Microsoft Authenticator passwordless sign-in

What will happen

  • Password-only users will be able to register passkeys or passwordless sign-in as their first MFA method.
  • Users will no longer need to register a method such as SMS or voice before registering a passkey (FIDO2), Windows Hello for Business, macOS Platform SSO, or Authenticator passwordless sign-in.
  • Organizations may see reduced registration friction and increased adoption of phishing-resistant authentication methods.
  • Users who are enabled for passkeys will be prompted to register a passkey by default when completing applicable registration experiences, including those triggered by multifactor authentication (MFA) enforcement and Conditional Access authentication strengths. Security Defaults MFA registration prompts will adopt this experience in January–February 2027.

[Action required and recommendations]

No action is required for this change.

We recommend that administrators:

  • Review Conditional Access policies related to security information registration.
  • Consider requiring MFA to register security information if additional verification is required by your organization.
  • Review your user onboarding and registration guidance and update it as needed to reflect that eligible users may be prompted to register a passkey by default.

Learn more 

[Compliance considerations]

QuestionAnswer
Does the change include an admin control?Yes. Administrators can control which authentication methods users are allowed to register through existing Microsoft Entra authentication method policies and Conditional Access policies.
Does the change affect access or authentication controls?Yes. The update changes how users register multifactor authentication methods by allowing eligible users to register supported passkeys or passwordless authentication methods as their first MFA method.
Can administrators govern the feature through existing Microsoft Entra controls?Yes. Administrators retain control over the feature through Microsoft Entra authentication method policies and Conditional Access configurations.

Source: Microsoft Message Center • Analysed by MWPro

<<< [MC1450133] Archive
Tooltip: View earlier revisions of this post

Share This Update
Tags: