Microsoft Entra: Optimized passkey registration campaign experience

Microsoft Entra is enhancing passkey registration campaigns to optimize user experience and increase phishing-resistant authentication adoption. Eligible users will be automatically prompted based on qualifying passkey profiles. Rollout begins early September 2026. Administrators should review campaign configurations and user assignments before rollout. Following earlier announcements regarding passkey registration campaigns and targeting logic (MC1279092 and MC1440968), we’re continuing to refine how Microsoft Entra identifies and guides eligible users toward passkey registration. These changes help increase adoption of phishing-resistant authentication while maintaining alignment with administrator-configured passkey policies. We’re introducing enhancements to the Microsoft Entra registration campaign to help organizations increase passkey registration and adoption. With this change, users who are eligible to register a passkey will receive an optimized registration experience. We’re also expanding the Microsoft managed registration campaign experience so that users assigned to qualifying passkey profiles can be automatically prompted to register a passkey. These updates help organizations accelerate adoption of phishing-resistant authentication while continuing to honor configured passkey policies and administrative controls. A passkey profile qualifies when it meets one of the following criteria: Passkey profile configuration Qualification criteria Unrestricted No passkey profile restrictions are configured. Synced-only Only synced passkeys are allowed and no key restrictions are configured. Device-bound-only Only device-bound passkeys are allowed and no key restrictions are configured. AAGUID-restricted The allow list contains at least one AAGUID for iCloud Keychain, Google Password Manager (GPM), Microsoft Authenticator passkey, or Microsoft Entra passkey on Windows. Device-bound with attestation enforced The profile qualifies regardless of key restrictions. Key restrictions are not evaluated. Rollout schedule General Availability (Worldwide, GCC): Beginning in early September 2026 and expected to complete by mid-September 2026 Impact on your organization Who is affected Administrators who manage Microsoft Entra registration campaigns and passkey authentication method policies Users who are in scope for a registration campaign and are permitted to register passkeys Platforms and services Microsoft Entra registration campaign Microsoft Entra authentication methods policy Passkey registration experience What will happen Eligible users will receive an optimized passkey registration experience. When a registration campaign is in the Microsoft managed state, Microsoft will evaluate each in-scope user’s passkey profile at […]

The post Microsoft Entra: Optimized passkey registration campaign experience appeared first on M365 Admin.