ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Authentication registration campaigns

Timelines and exceptions · All guidance changes

Entra · Official Microsoft guidanceObserved changes retained

Observed content change

14 new passages (about 460 words), 4 edited passages (107 words changed), 15 removed passages (about 280 words). The changed wording mentions prerequisites, permissions, supported platforms, settings and controls. Review the source to confirm the effect.

May need admin actionCheck whether new requirements apply to your setup; check the roles and permissions you grant; check the platforms and versions you run.

Requirement wordingSupport wording
NewHow passkey registration nudges are evaluated
[added: After a user meets the registration campaign’s eligibility requirements, their passkey profile determines whether existing registered passkeys suppress the nudge across all platforms or only for the current operating system and browser combination (platform). Start with the profile table. Use the platform table only when platform-specific evaluation applies.]
NewHow passkey registration nudges are evaluated
[added: These rules apply to passkey campaigns in both the Enabled and Microsoft managed states. They are separate from passkey profile eligibility for the Microsoft managed registration campaign. In the Microsoft managed state, only users assigned to at least one eligible passkey profile are nudged. In contrast, when the registration campaign is set to Enabled, any user who is enabled for passkeys can be nudged, regardless of their passkey profile.]
NewStep 1: Determine how the passkey profile affects the nudge
[added: Some passkey profiles evaluate credentials separately for each OS and browser combination. Other profiles suppress nudges across platforms after the user registers an eligible passkey.]
EditedStep 1: Determine how the passkey profile affects the nudge
Passkey profile configuration [removed: How] [added: Does platform-specific evaluation apply? When is] the nudge [removed: is evaluated] [added: suppressed?] Unrestricted [removed: Suppressed per] [added: Yes When the user has a qualifying credential available for the current] OS and browser [removed: according to] [added: combination. See] the [removed: preceding table, once] [added: platform table below. Synced-only Yes When] the user has a qualifying local [added: synced] passkey [added: available] for [removed: that] [added: the current] platform. [removed: Synced-only The] [added: Otherwise, the] user is nudged [removed: to register a local synced passkey] on [removed: each platform] [added: platforms] where [removed: one is possible. The nudge is suppressed on] a [removed: platform after] [added: compatible synced passkey can be registered. Device-bound-only Yes When] the user has a qualifying local [removed: synced] [added: device-bound] passkey [removed: available. Device-bound-only The] [added: available for the current platform. Otherwise, the] user is nudged [removed: to register a local device-bound passkey] on [removed: each platform] [added: platforms] where [removed: one is possible. The nudge is suppressed on] a [removed: platform after the user has a qualifying local] [added: compatible] device-bound passkey [removed: available.] [added: can be registered.] AAGUID-restricted [removed: The per-platform evaluation doesn't apply.] [added: No] After the user registers one eligible passkey, the nudge [removed: stops on all] [added: is suppressed across] OS and browser [removed: combinations.] [added: combinations under this profile’s rule.] Device-bound with attestation enforced [removed: The per-platform evaluation doesn't apply.] [added: No] After the user registers one eligible passkey, the nudge [removed: stops on all] [added: is suppressed across] OS and browser [removed: combinations.] [added: combinations under this profile’s rule.]
NewStep 1: Determine how the passkey profile affects the nudge
[added: An eligible passkey must meet the applicable profile requirements. Registering a passkey that doesn’t meet those requirements doesn’t satisfy the profile’s nudge-suppression condition. Windows Hello for Business registration doesn’t follow passkey profile restrictions. For example, a user assigned to a synced-only passkey profile can still register Windows Hello for Business.]
NewStep 2: Evaluate the platform, when required
[added: For unrestricted, synced-only, and device-bound-only profiles, the campaign evaluates whether a qualifying credential is available for the user’s current OS and browser combination.]
NewStep 2: Evaluate the platform, when required
[added: A passkey registered on the account doesn’t necessarily suppress the nudge on every platform. It must qualify under the applicable profile and satisfy the platform-specific rule.]
NewStep 2: Evaluate the platform, when required
[added: The following table shows which available passkey types suppress the nudge on each platform.]
EditedStep 2: Evaluate the platform, when required
Available passkey type Windows + Chrome Windows + other browsers macOS + Chrome macOS + other browsers iOS Android Windows Hello for Business [removed: ✔️ ✔️] [added: ✓ ✓] — — — — Microsoft Entra passkey on Windows [removed: ✔️ ✔️] [added: ✓ ✓] — — — — Google Password Manager [removed: ✔️] [added: ✓] — [removed: ✔️] [added: ✓] — — [removed: ✔️] [added: ✓] iCloud [removed: Keychain (including Managed)] [added: Keychain, including Managed] — — [removed: ✔️ ✔️ ✔️] [added: ✓ ✓ ✓] — macOS Platform SSO — — [removed: ✔️ ✔️] [added: ✓ ✓] — — Samsung Pass — — — — — [removed: ✔️] [added: ✓] Passkey in Microsoft Authenticator — — — — [removed: ✔️ ✔️] [added: ✓ ✓] Any cross-platform provider, such as a security key [removed: ✔️ ✔️ ✔️ ✔️ ✔️ ✔️] [added: ✓ ✓ ✓ ✓ ✓ ✓]
NewStep 2: Evaluate the platform, when required
[added: ✓ The available credential suppresses the platform-specific nudge, subject to the applicable profile requirements.]
NewStep 2: Evaluate the platform, when required
[added: — The credential doesn’t suppress the nudge under this platform-specific rule. This symbol is not a statement about whether the credential can be used to authenticate on that platform.]
EditedStep 2: Evaluate the platform, when required
Note Linux users aren[removed: '][added: ’]t nudged by passkey registration campaigns.
NewExamples
[added: The following examples assume that all other campaign requirements are met and that the user is scoped only to the profile described.]
NewExamples
[added: Scenario Expected nudge behavior User 1 has an unrestricted profile, and their only registered passkey is Windows Hello for Business. They sign in on Windows with Chrome. The nudge is suppressed for that platform. User 1 then signs in on macOS with Chrome. The user is nudged to register a compatible passkey. Their Windows Hello for Business credential doesn’t suppress the macOS nudge. User 2 has a device-bound profile with attestation enforced. They have registered an eligible attested passkey. The nudge is suppressed across OS and browser combinations under that profile’s rule; the platform table isn’t used.]
NewCan users be nudged within an SSO session?
[added: Yes, during interactive sign-ins that satisfy multifactor authentication (MFA), provided users meet the registration campaign's other eligibility requirements. Silent SSO events that occur without user interaction, such as refresh token redemption, don't display nudges.]
RemovedRun a registration campaign to set up a passkey or Microsoft Authenticator
[removed: Note]
RemovedRun a registration campaign to set up a passkey or Microsoft Authenticator
[removed: Access to this page requires authorization. You can try signing in or changing directories.]
RemovedRun a registration campaign to set up a passkey or Microsoft Authenticator
[removed: Access to this page requires authorization. You can try changing directories.]
RemovedPasskey nudge evaluation by platform
[removed: After a user is deemed eligible to enroll a passkey based on the registration campaign settings, the campaign performs a further evaluation before nudging them. The campaign checks whether the user already has a local passkey for their current OS and browser combination (platform).]
RemovedPasskey nudge evaluation by platform
[removed: The following table shows which platform passkey types suppress the nudge on each OS and browser combination. A user needs at least one matching passkey type on an OS and browser combination for the nudge to be suppressed. Otherwise, if all other campaign requirements are met, they're nudged to register a compatible passkey type.]

Microsoft's wording from Microsoft source, © Microsoft Corporation, under MIT. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.

Read the current Microsoft source · Link to this observation · Compare any two versions

Sections to inspect

Up to 12 section headings from retained before/after evidence. The current source may have changed again.

Why this was flagged

The changed words, with a few words around them, matched these rule categories: prerequisites, permissions, supported platforms, settings and controls. These matches identify subjects to assess; they do not establish a policy change or applicability.

Observation details · observed 12 Oct 19:50 UTC
Observed by ChangeIntel
12 Oct 19:50 UTC
Source update metadata
12 Oct 17:45 UTC
Microsoft's latest commit in that period
Merge pull request #14574 from JasSuri/docs/clarify-registration-campaign-sso-nudge · committed 12 Oct 15:55 UTC · View diff
First observed on this installation
5 Oct 23:18 UTC
Last successful check
today 20:00 UTC
Next check due
21 Oct 02:00 UTC

Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.

Watch this page to review its changes in My radar.

Timeline

From the capture of 12 Oct 19:50 UTC

Requirements, exceptions and scope

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

  3. No longer on the page Any cross-platform provider, such as a security keyin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  4. No longer on the page Passkey in Microsoft Authenticatorin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  5. No longer on the page Samsung Passin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  6. No longer on the page Windows Hello for Businessin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  7. No longer on the page Google Password Managerin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  8. No longer on the page iCloud Keychain, including Managedin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  9. No longer on the page macOS Platform SSOin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  10. No longer on the page Microsoft Entra passkey on Windowsin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  11. Requirement added Any cross-platform provider, such as a security keyin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  12. Requirement added Passkey in Microsoft Authenticatorin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
126 earlier changes
  1. Requirement added Samsung Passin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  2. Requirement added Windows Hello for Businessin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  3. Requirement added Google Password Managerin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  4. Requirement added iCloud Keychain, including Managedin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  5. Requirement added macOS Platform SSOin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  6. Requirement added Microsoft Entra passkey on Windowsin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 58da48a
  19. No longer on the page Device-bound-onlyin How the passkey profile affects the nudge evaluationMicrosoft's source, commit 43078f8
  20. No longer on the page Synced-onlyin How the passkey profile affects the nudge evaluationMicrosoft's source, commit 43078f8
  21. Exception added Device-bound-onlyin Step 1: Determine how the passkey profile affects the nudgeMicrosoft's source, commit 43078f8
  22. Exception added Synced-onlyin Step 1: Determine how the passkey profile affects the nudgeMicrosoft's source, commit 43078f8
  25. Requirement added Any cross-platform provider, such as a security keyin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  26. Requirement added Passkey in Microsoft Authenticatorin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  27. Requirement added Samsung Passin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  28. Requirement added Windows Hello for Businessin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  29. Requirement added Google Password Managerin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  30. Requirement added iCloud Keychain, including Managedin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  31. Requirement added macOS Platform SSOin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  32. Requirement added Microsoft Entra passkey on Windowsin Step 2: Evaluate the platform, when requiredMicrosoft's source, commit 43078f8
  38. No longer on the page iCloud Keychain (including Managed)in Passkey nudge evaluation by platformMicrosoft's source, commit 43078f8
  47. Exception added Device-bound-onlyin How the passkey profile affects the nudge evaluationMicrosoft's source, commit ab76f7d
  48. Exception added Synced-onlyin How the passkey profile affects the nudge evaluationMicrosoft's source, commit ab76f7d
  51. Exception added Device-bound-onlyin Passkey profile eligibility for Microsoft managed registration campaignMicrosoft's source, commit ab76f7d
  52. Exception added Synced-onlyin Passkey profile eligibility for Microsoft managed registration campaignMicrosoft's source, commit ab76f7d
  66. Requirement added Limited number of snoozesin Microsoft managed stateMicrosoft's source, commit ab76f7d
  78. No longer on the page iCloud Keychain (including Managed)in Passkey nudge evaluation by platformMicrosoft's source, commit ab76f7d
  79. Scope added iCloud Keychain (including Managed)in Passkey nudge evaluation by platformMicrosoft's source, commit ab76f7d
  101. Requirement added enforceRegistrationAfterAllowedSnoozesin Enable the registration campaign policy by using Graph ExplorerMicrosoft's source, commit 6f600eb
  105. No longer on the page enforceRegistrationAfterAllowedSnoozesin Enable the registration campaign policy using Graph ExplorerMicrosoft's source, commit 6f600eb
  122. Scope added excludeTargetsin Enable the registration campaign policy by using Graph ExplorerMicrosoft's source, commit 6f600eb
  124. No longer on the page excludeTargetsin Enable the registration campaign policy using Graph ExplorerMicrosoft's source, commit 6f600eb
  126. Scope added iCloud Keychain (including Managed)in Passkey nudge evaluation by platformMicrosoft's source, commit 8192979
Observed history and review priority

Captured 12 Oct 19:50 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.

Review priority. Previously extracted guidance is missing from a later capture · Extracted assertions require review · Publisher marks guidance tentative · Applicability or exceptions require review

0 date changes and 0 condition changes across 1 compared revisions. Suggested check interval: 6 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 22

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

Microsoft's edits

History on GitHub

Commits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read 19 Oct 23:56 UTC.

  1. Merge pull request #14574 from JasSuri/docs/clarify-registration-campaign-sso-nudge Served on LearnView diff
  2. Use unambiguous attestation example View diff
  3. Connect macOS nudge example to User 1 View diff
  4. Clarify unrestricted profile example View diff
  5. Use passkey terminology for nudge suppression View diff
  6. Document Windows Hello profile exception View diff
  7. Clarify Windows Hello profile behavior View diff
  8. Link Microsoft managed profile eligibility guidance View diff
  9. Clarify profile-first passkey nudge evaluation View diff
  10. Clarify registration campaign nudges during SSO View diff
  11. Remove registration campaign rollout note View diff
  12. Clarify registration campaign MFA requirements View diff
  13. Rewrite registration campaign guidance for passkeys and Authenticator (#14300) View diff
  14. Add Passkey in Microsoft Authenticator App row to nudge evaluation table View diff
  15. Update registration campaign FAQ for mobile and guest user support (#13480) View diff
  16. [AQ] edit pass: Security info registration (#13295) View diff
  17. Remove Microsoft Password Manager row and Edge columns from passkey nudge table (#13316) View diff
  18. Add lightbox and border to registration campaign screenshot View diff
  19. Add note about snooze count persistence in registration campaign View diff
  20. Update registration campaign: remove screenshot, fix "sync passkey" to "synced passkey" View diff
  21. Merge Justinha-patch-1: resolve conflict, keep web editor changes View diff
  22. Update titles and descriptions for clarity View diff
  23. Apply copy-edit, security, and tech-accuracy review fixes View diff
  24. Update passkey nudge limitations and platform table clarity View diff
  25. Copy-edit: fix style, accessibility, and SEO issues View diff
  26. Remove Windows browser nudge note from MFA registration campaign View diff
  27. Replace passkey nudge table with detailed platform matrix View diff
  28. Remove outdated mobile limitation that conflicts with matrix View diff
  29. Merge non-platform provider row into passkey nudge table View diff
1 metadata-only edit · author, dates or topic labels, no article text
  1. [BULK UPDATE] User Story 573314: Ensure every doc in MSec repos has an author from MSec Docs (entra-docs-pr 4) (#13372) Metadata onlyView diff

Suggested by a shared curated topic and product; not a verified connection (6 items)

Retained observations

  • 12 Oct 19:50 UTC · shown above
  • 7 Oct 23:38 UTC

    1 removed passage (about 40 words). The changed wording mentions dates and deadlines. Review the source to confirm the effect.

  • 5 Oct 23:18 UTC

    Baseline for retained history; no earlier retained text to compare.

What changed

First observed 18 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.