Microsoft Entra: System-preferred authentication now applies to first-factor authentication

Microsoft Entra now applies system-preferred authentication to first-factor sign-in for tenants in the Microsoft managed state, selecting the most secure registered method. Rollout starts late June 2026. Tenants can keep or change this setting and should update user guidance accordingly. What and Why As announced in the What’s New (June Edition), we have been rolling out first-factor system-preferred authentication in the Microsoft-managed state. System-preferred authentication in Microsoft Entra ID now applies to both first-factor and second-factor authentication when the setting is in the Microsoft managed state. The system evaluates which credentials are registered for the user and selects the highest-ranked method for each authentication step, prompting the user to sign in with the most secure available method. Rollout schedule General Availability (Worldwide): Beginning late June 2026 and expected to complete by late July 2026 Impact on your organization Who is affected Organizations whose system-preferred authentication setting is in the Microsoft managed state. If your setting is in the Enabled or Disabled state, first-factor sign-in behavior remains unchanged and there is no impact from this update. Platforms and services Microsoft Entra ID System-preferred authentication User sign-in experiences What will happen For tenants in the Microsoft managed state, the system applies credential ranking to both first-factor and second-factor authentication. When a user signs in, the authentication process checks which authentication methods are registered and prompts the user with the most secure method according to the system-defined order. The method order is dynamic and can update when users register more secure authentication methods, such as a passkey, or as Microsoft updates credential rankings based on evolving security guidance. For example, if a user has both a password and a passkey registered, Microsoft Entra may prompt the user to use the passkey at their next first-factor sign-in instead of the password. To sign in using a different option, users can always cancel and choose another available sign-in method. Behavior by setting state: Microsoft managed: The system applies credential ranking to both first-factor and second-factor authentication. Enabled: Credential ranking applies only to second-factor authentication. First-factor sign-in behavior remains unchanged. Disabled: System-preferred authentication is not applied. […]

The post Microsoft Entra: System-preferred authentication now applies to first-factor authentication appeared first on M365 Admin.