Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors

Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors starting October 2026, allowing users to meet MFA requirements without additional passkeys. No configuration changes are needed, but organizations should update onboarding and documentation accordingly. Microsoft Entra will soon recognize Windows Hello for Business (WHfB) and macOS Platform Single Sign-On (PSSO) as standalone multifactor authentication (MFA) factors in supported authentication scenarios. Today, WHfB and macOS PSSO can satisfy MFA requirements during primary sign-in, but users may still be required to register and use an additional passkey or authentication method for certain step-up authentication prompts, Authentication Strength policies, and sign-in frequency checks. After this rollout, users who authenticate with WHfB or macOS PSSO will be able to satisfy supported MFA requirements without registering an additional passkey. This change helps organizations expand the use of phishing-resistant authentication methods and reduce reliance on less secure authentication methods. Rollout schedule General Availability (Worldwide, GCC): Beginning in early October 2026 and expected to complete in late November 2026 Impact on your organization Who is affected Organizations using Microsoft Entra ID Users who authenticate with Windows Hello for Business Users who authenticate with macOS Platform SSO Organizations using Conditional Access Authentication Strength policies Platforms and services Microsoft Entra ID Windows Hello for Business macOS Platform SSO Conditional Access Authentication Strength policies What will happen After rollout: Users signing in with WHfB or macOS PSSO can complete supported MFA challenges without requiring a separate passkey. WHfB and macOS PSSO will satisfy supported MFA requirements for step-up authentication scenarios. WHfB and macOS PSSO can be used during 2FA to satisfy supported Authentication Strength policy requirements. WHfB and macOS PSSO can be used during 2FA to satisfy supported sign-in frequency challenge requirements. Users whose only MFA method is WHfB or macOS PSSO will be considered MFA-capable. Users who sign in with only a password will no longer be automatically prompted to register an additional MFA method if WHfB or macOS PSSO is their only registered MFA credential. Action required and recommendations No configuration changes are required. We recommend reviewing user onboarding and MFA registration […]

The post Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors appeared first on M365 Admin.