Posted inMicrosoft Entra

MC1450134: Microsoft Entra Adds Windows Hello for Business and macOS Platform SSO as Standalone MFA Factors

4 minutesPosted inMicrosoft Entra
MWPRO IMPACT SCORE
OPERATIONAL IMPACT
49
0 25 50 75 100
MODERATE IMPACT • ASSESS BUSINESS IMPACT
Recommended Action:
Take a look and decide whether this affects your tenant, users or support teams.
▶ What is MWPro Impact Score? Watch our 60‑second explainer

Primary Audience

Tenant AdminsMicrosoft 365 AdminsSecurity TeamsCompliance TeamsIT ManagersService Owners
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
Microsoft delayed the general availability of recognising Windows Hello for Business and macOS Platform SSO as standalone MFA factors from October to November 2026. Admins should update user onboarding, authentication policies and documentation to reflect these platform methods as compliant MFA options. The change reduces redundant MFA registration but may require review of sign-in and conditional access scenarios. No immediate configuration changes are required but moderate preparation and testing are advisable before GA rollout.
60
🛡️ Admin Impact
HIGH
35
👥 User Impact
MEDIUM
45
⚡ Urgency
MEDIUM
40
🔧 Effort
MEDIUM
ℹ️ WHAT YOU NEED TO KNOW
📌

AT A GLANCE

Microsoft Entra will treat Windows Hello for Business and macOS Platform SSO as standalone MFA factors. This reduces the need for extra MFA registration and supports phishing-resistant sign-ins.
👥

END USERS

Users may no longer need to register or use an extra MFA method if using WHfB or macOS PSSO.
🛡️

IT ADMINS

Review MFA registration and onboarding guides, and check Authentication Strength policies before rollout.
📅

ROLLOUT TIMELINE

Upcoming:
Early November 2026

📢 Official Microsoft Message Center Announcement

(Updated) Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors
Message ID: MC1450134 (Updated)

Updated October 27, 2026: We have updated the timeline. Thank you for your patience. 

[What and why]

Microsoft Entra will soon recognize Windows Hello for Business (WHfB) and macOS Platform Single Sign-On (PSSO) as standalone multifactor authentication (MFA) factors in supported authentication scenarios.

Today, WHfB and macOS PSSO can satisfy MFA requirements during primary sign-in, but users may still be required to register and use an additional passkey or authentication method for certain step-up authentication prompts, Authentication Strength policies, and sign-in frequency checks.

After this rollout, users who authenticate with WHfB or macOS PSSO will be able to satisfy supported MFA requirements without registering an additional passkey. This change helps organizations expand the use of phishing-resistant authentication methods and reduce reliance on less secure authentication methods. As part of this change, a user’s WHfB and macOS PSSO credentials will be displayed in My Security Info as auto-registered passkeys.

[Rollout schedule]

  • General Availability (Worldwide, GCC): Beginning in early November 2026 (previously early October) and expected to complete in late December 2026 (previously mid-December)

[Impact on your organization]

Who is affected

  • Organizations using Microsoft Entra ID
  • Users who authenticate with Windows Hello for Business
  • Users who authenticate with macOS Platform SSO
  • Organizations using Conditional Access Authentication Strength policies

Platforms and services

  • Microsoft Entra ID
  • Windows Hello for Business
  • macOS Platform SSO
  • Conditional Access
  • Authentication Strength policies

What will happen

After rollout:

  • Users signing in with WHfB or macOS PSSO can complete supported MFA challenges without requiring a separate passkey.
  • WHfB and macOS PSSO will satisfy supported MFA requirements for step-up authentication scenarios.
  • WHfB and macOS PSSO can be used during 2FA to satisfy supported Authentication Strength policy requirements.
  • WHfB and macOS PSSO can be used during 2FA to satisfy supported sign-in frequency challenge requirements.
  • Users whose only MFA method is WHfB or macOS PSSO will be considered MFA-capable.
  • Users who sign in with only a password will no longer be automatically prompted to register an additional MFA method if WHfB or macOS PSSO is their only registered MFA credential.
  • Users with WHfB or macOS PSSO credentials, will be able to see them listed in My Security Info as auto-registered passkeys.

[Action required and recommendations]

No configuration changes are required.

We recommend reviewing user onboarding and MFA registration processes before rollout. Because WHfB and macOS PSSO credentials are device-bound, users may not be able to complete MFA challenges from devices where those credentials are not available.

Recommended actions:

  • Update onboarding guidance to ensure users register at least one portable MFA method.
  • Consider requiring users to register a synced passkey or Microsoft Authenticator passkey in addition to WHfB or macOS PSSO.
  • Review custom Authentication Strength policies to confirm WHfB and macOS PSSO are allowed where appropriate.
  • Update user documentation because users with only WHfB or macOS PSSO registered will no longer be automatically guided to register an additional MFA method.

Learn more (To be updated closer to GA rollout.)

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.

Source: Microsoft Message Center • Analysed by MWPro

<<< [MC1450134] Archive
Tooltip: View earlier revisions of this post

Share This Update
Tags: