Microsoft Entra: Passkeys in Microsoft registration campaigns

Starting April 2026, Microsoft Registration Campaigns will support Passkeys (FIDO2) as an additional authentication method, enabling phishing-resistant credentials. Eligible Microsoft 365 tenants can opt users into Passkey registration nudges during sign-in. Changes will roll out gradually, affecting MFA-capable users with specific policy settings. As previously announced in MC1221452, Microsoft Registration Campaigns will support Passkeys (FIDO2) as an additional authentication method starting in early April 2026. This update helps organizations accelerate adoption of phishing‑resistant credentials by allowing administrators to opt users into Passkeys and deliver Passkey registration nudges during sign‑in. When this will happen  General Availability (Worldwide): We will begin rolling out in early April 2026 and expect to complete in late May 2026. How this affects your organization Who is affected Microsoft 365 tenants using Microsoft Registration Campaigns Tenants configured in either Microsoft‑managed or Enabled states Users who are MFA‑capable and eligible for Passkeys (FIDO2) What will happen Microsoft‑managed state Your tenant will be impacted when all of the following conditions are met: The Passkeys (FIDO2) authentication method policy is enabled. Allow self‑service setup is enabled. Target specific AAGUIDs is not selected (no AAGUID restrictions configured). The Authentication Methods Registration Campaign state is set to Microsoft‑managed. When these conditions are met, the following settings will update automatically: The targeted authentication method will change from Microsoft Authenticator to Passkeys (FIDO2). Days allowed to snooze will change from three days to one day. (This setting will no longer be configurable.) Limit number of snoozes will be disabled. (This setting will no longer be configurable.) Targeting will expand to all MFA‑capable users. (This setting will no longer be configurable.) Default user targeting will change from voice call or text message users to all multifactor authentication (MFA)–capable users. Affected users will receive Passkey registration nudges at sign‑in after completing MFA. We will roll out these changes incrementally over time to in‑scope tenants. Enabled state Passkey (FIDO2) can be selected as the Targeted Authentication Method when Microsoft Registration Campaigns are in the Enabled state.  Note: Registration Campaigns support targeting only one authentication method at a time—either Microsoft Authenticator or Passkeys (FIDO2), but not both simultaneously. What […]

The post Microsoft Entra: Passkeys in Microsoft registration campaigns appeared first on M365 Admin.