Passkeys in Microsoft Authenticator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit b21a84b · +26 −6 lines · also on GitHub
⋯ 1 unchanged line
22
title: Enable and support passkeys in Authenticator for Microsoft Entra ID
33
description: Learn about Authenticator-specific requirements, configuration, and troubleshooting for passkeys in Microsoft Authenticator for Microsoft Entra ID.
44
ms.topic: how-to
5
−ms.date: 07/05/2026
6
−ms.reviewer: mjsantani, calui, tilarso
5
+ms.date: 10/02/2026
6
+ms.reviewer: mjsantani, guptashi, tilarso
77
ms.collection: M365-identity-device-management
88
ms.custom: sfi-ga-nochange, sfi-image-nochange, msecd-doc-authoring-1013
99
ai-usage: ai-assisted
⋯ 184 unchanged lines
194194
195195
<sup>1</sup>For users to register new sign-in methods, your grant control for the mobile policy needs to match your Conditional Access policy to register [Security info](https://mysignins.microsoft.com/security-info).
196196
197
+- You can exclude the **Microsoft Authenticator Credential Registration** resource from the Conditional Access policy.
198
+
199
+ > [!NOTE]
200
+ > The Microsoft Authenticator Credential Registration resource will be available in November 2026. Before you can exclude the resource from a Conditional Access policy, you must provision the Microsoft Authenticator Credential Registration enterprise application in your tenant.
201
+
202
+ As a Cloud Application Administrator or Application Administrator:
203
+
204
+ 1. Manually provision the **Microsoft Authenticator Credential Registration** app by using one of the [supported methods for creating an enterprise application from a multitenant app](/entra/identity/enterprise-apps/create-service-principal-cross-tenant?pivots=ms-graph). Use the following details:
205
+
206
+ - **App ID**: `6aa00308-ea33-4caa-90d6-ae905d8cb51b`
207
+ - **Required role**: Cloud Application Administrator or Application Administrator
208
+
209
+ For example, use Microsoft Graph Explorer to make a `POST` request to `https://graph.microsoft.com/v1.0/servicePrincipals` with the following body:
210
+
211
+ ```json
212
+ {
213
+ "appId": "6aa00308-ea33-4caa-90d6-ae905d8cb51b"
214
+ }
215
+ ```
216
+
217
+ 1. After you provision the app, **Microsoft Authenticator Credential Registration** appears as a resource in Conditional Access. Exclude it from any Conditional Access policies scoped to **All resources** to unblock passkey registration in Microsoft Authenticator.
218
+
197219
> [!NOTE]
198
−> With either workaround, users must also satisfy any Conditional Access policy that targets **Register security info** or they can't register the passkey. If you have other conditions set up with the **All resources** policies, those conditions must be met when the passkey is registered.
220
+> With any workaround, users must also satisfy any Conditional Access policy that targets **Register security info** or they can't register the passkey. If you have other conditions set up with the **All resources** policies, those conditions must be met when the passkey is registered.
199221
200222
### Users who can't register passkeys because of Require approved client app or Require app protection policy Conditional Access grant controls
201223
⋯ 14 unchanged lines
216238
- Targeted resource: **All resources (formerly 'All cloud apps')**
217239
- Grant control: **Require approved client app**, or **Require app protection policy**, or **Require device to be marked as compliant**
218240
219
−- You can grant users a temporary exemption from the Conditional Access policy. Consider using one or more compensating controls:
220
− - Allow the exemption for only a limited period of time. Communicate to the user when they're allowed to register a passkey. Remove the exemption after the time period. Then direct users to call the help desk if they missed their time.
221
− - Use another Conditional Access policy to require that users register only from a specific network location or a compliant device.
241
+- You can also change the Conditional Access policy structure to [exclude the Microsoft Authenticator Credential Registration resource](#workarounds-for-an-authentication-strength-conditional-access-policy-loop).
222242
223243
> [!NOTE]
224244
> With any proposed workaround, users must also satisfy any Conditional Access policy that targets **Register security info** or they can't register the passkey. If you have other conditions set up with the **All resources** policies, they also must be met before users can register a passkey.
⋯ 21 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 29 Oct 00:39 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.