Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method

Users can now register passkeys or passwordless sign-in as their first multifactor authentication method in Microsoft Entra, removing the prior requirement to register weaker methods first. This change, rolling out in phases from January 2026 to November 2027, aims to simplify adoption of phishing-resistant sign-in. Users will soon be able to register a passkey as their first multifactor authentication method. Previously, people had to set up an alternate MFA method like SMS or Voice before they could add a passkey (FIDO2), Windows Hello for Business, macOS Platform SSO. That extra step pushed users toward weaker methods and slowed the move to phishing-resistant sign-in. Now password-only users can go straight to a passkey, making it easier to adopt strong authentication from day one. As part of this work, we will also be enabling Authenticator App passwordless sign-in to be a user’s first registered MFA method.  Rollout schedule This feature will roll out in phases:  Phase 1: Support for synced passkeys, Microsoft Entra passkeys on Windows, and FIDO2 security keys.   General Availability (Worldwide, GCC): We will begin rolling out in mid-October 2026 and expect to complete by mid-November 2026.  Phase 2: Support for Windows Hello for Business, macOS Platform SSO, and Authenticator App passwordless sign-in.  General Availability (Worldwide, GCC): We will begin rolling out in early January 2026 and expect to complete by late February 2027.  Impact on your organization Who is affected Users who have not yet registered a multifactor authentication method Identity and security administrators responsible for authentication onboarding and registration policies Platforms and services Microsoft Entra ID Passkeys (FIDO2) Windows Hello for Business macOS Platform SSO Microsoft Authenticator passwordless sign-in What will happen Password-only users will be able to register passkeys or passwordless sign-in as their first MFA method. Users will no longer need to register a method such as SMS or voice before registering a passkey (FIDO2), Windows Hello for Business, macOS Platform SSO, or Authenticator passwordless sign-in. Organizations may see reduced registration friction and increased adoption of phishing-resistant authentication methods. Action required and recommendations No action is required for this change. We recommend that administrators: Review Conditional […]

The post Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method appeared first on M365 Admin.