Authentication registration campaigns

[added: After a user meets the registration campaign’s eligibility requirements, their passkey profile determines whether existing registered passkeys suppress the nudge across all platforms or only for the current operating system and browser combination (platform). Start with the profile table. Use the platform table only when platform-specific evaluation applies.]

[added: These rules apply to passkey campaigns in both the Enabled and Microsoft managed states. They are separate from passkey profile eligibility for the Microsoft managed registration campaign. In the Microsoft managed state, only users assigned to at least one eligible passkey profile are nudged. In contrast, when the registration campaign is set to Enabled, any user who is enabled for passkeys can be nudged, regardless of their passkey profile.]

[added: Some passkey profiles evaluate credentials separately for each OS and browser combination. Other profiles suppress nudges across platforms after the user registers an eligible passkey.]

Passkey profile configuration [removed: How] [added: Does platform-specific evaluation apply? When is] the nudge [removed: is evaluated] [added: suppressed?] Unrestricted [removed: Suppressed per] [added: Yes When the user has a qualifying credential available for the current] OS and browser [removed: according to] [added: combination. See] the [removed: preceding table, once] [added: platform table below. Synced-only Yes When] the user has a qualifying local [added: synced] passkey [added: available] for [removed: that] [added: the current] platform. [removed: Synced-only The] [added: Otherwise, the] user is nudged [removed: to register a local synced passkey] on [removed: each platform] [added: platforms] where [removed: one is possible. The nudge is suppressed on] a [removed: platform after] [added: compatible synced passkey can be registered. Device-bound-only Yes When] the user has a qualifying local [removed: synced] [added: device-bound] passkey [removed: available. Device-bound-only The] [added: available for the current platform. Otherwise, the] user is nudged [removed: to register a local device-bound passkey] on [removed: each platform] [added: platforms] where [removed: one is possible. The nudge is suppressed on] a [removed: platform after the user has a qualifying local] [added: compatible] device-bound passkey [removed: available.] [added: can be registered.] AAGUID-restricted [removed: The per-platform evaluation doesn't apply.] [added: No] After the user registers one eligible passkey, the nudge [removed: stops on all] [added: is suppressed across] OS and browser [removed: combinations.] [added: combinations under this profile’s rule.] Device-bound with attestation enforced [removed: The per-platform evaluation doesn't apply.] [added: No] After the user registers one eligible passkey, the nudge [removed: stops on all] [added: is suppressed across] OS and browser [removed: combinations.] [added: combinations under this profile’s rule.]

[added: An eligible passkey must meet the applicable profile requirements. Registering a passkey that doesn’t meet those requirements doesn’t satisfy the profile’s nudge-suppression condition. Windows Hello for Business registration doesn’t follow passkey profile restrictions. For example, a user assigned to a synced-only passkey profile can still register Windows Hello for Business.]

[added: For unrestricted, synced-only, and device-bound-only profiles, the campaign evaluates whether a qualifying credential is available for the user’s current OS and browser combination.]

[added: A passkey registered on the account doesn’t necessarily suppress the nudge on every platform. It must qualify under the applicable profile and satisfy the platform-specific rule.]

[added: The following table shows which available passkey types suppress the nudge on each platform.]

Available passkey type Windows + Chrome Windows + other browsers macOS + Chrome macOS + other browsers iOS Android Windows Hello for Business [removed: ✔️ ✔️] [added: ✓ ✓] — — — — Microsoft Entra passkey on Windows [removed: ✔️ ✔️] [added: ✓ ✓] — — — — Google Password Manager [removed: ✔️] [added: ✓] — [removed: ✔️] [added: ✓] — — [removed: ✔️] [added: ✓] iCloud [removed: Keychain (including Managed)] [added: Keychain, including Managed] — — [removed: ✔️ ✔️ ✔️] [added: ✓ ✓ ✓] — macOS Platform SSO — — [removed: ✔️ ✔️] [added: ✓ ✓] — — Samsung Pass — — — — — [removed: ✔️] [added: ✓] Passkey in Microsoft Authenticator — — — — [removed: ✔️ ✔️] [added: ✓ ✓] Any cross-platform provider, such as a security key [removed: ✔️ ✔️ ✔️ ✔️ ✔️ ✔️] [added: ✓ ✓ ✓ ✓ ✓ ✓]

[added: ✓ The available credential suppresses the platform-specific nudge, subject to the applicable profile requirements.]

[added: — The credential doesn’t suppress the nudge under this platform-specific rule. This symbol is not a statement about whether the credential can be used to authenticate on that platform.]

Note Linux users aren[removed: '][added: ’]t nudged by passkey registration campaigns.

[added: The following examples assume that all other campaign requirements are met and that the user is scoped only to the profile described.]

[added: Scenario Expected nudge behavior User 1 has an unrestricted profile, and their only registered passkey is Windows Hello for Business. They sign in on Windows with Chrome. The nudge is suppressed for that platform. User 1 then signs in on macOS with Chrome. The user is nudged to register a compatible passkey. Their Windows Hello for Business credential doesn’t suppress the macOS nudge. User 2 has a device-bound profile with attestation enforced. They have registered an eligible attested passkey. The nudge is suppressed across OS and browser combinations under that profile’s rule; the platform table isn’t used.]

[added: Yes, during interactive sign-ins that satisfy multifactor authentication (MFA), provided users meet the registration campaign's other eligibility requirements. Silent SSO events that occur without user interaction, such as refresh token redemption, don't display nudges.]

[removed: Note]

[removed: Access to this page requires authorization. You can try signing in or changing directories.]

[removed: Access to this page requires authorization. You can try changing directories.]

[removed: After a user is deemed eligible to enroll a passkey based on the registration campaign settings, the campaign performs a further evaluation before nudging them. The campaign checks whether the user already has a local passkey for their current OS and browser combination (platform).]

[removed: The following table shows which platform passkey types suppress the nudge on each OS and browser combination. A user needs at least one matching passkey type on an OS and browser combination for the nudge to be suppressed. Otherwise, if all other campaign requirements are met, they're nudged to register a compatible passkey type.]