A new workaround for authentication strength Conditional Access policy loops: Microsoft Authenticator Credential Registration service principal

Microsoft has added a new workaround for a specific Conditional Access loop that can stop users from registering a passkey in Microsoft Authenticator.

The loop can happen when a policy targets All resources and requires users to authenticate with a passkey in Authenticator. The policy then requires a passkey when a user is trying to add that same passkey. They can’t satisfy the requirement until registration is complete, which causes a loop or lockout.