Passkeys in Microsoft Authenticator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f354a0f · +4 −1 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.service: entra-id
55
ms.subservice: authentication
66
ms.topic: how-to
7
−ms.date: 04/02/2025
7
+ms.date: 06/24/2025
88
ms.author: justinha
99
author: justinha
1010
manager: dougeby
⋯ 19 unchanged lines
3030
> Users can't use cross-device registration if you enable attestation.
3131
3232
To learn more about FIDO2 support, see [Support for FIDO2 authentication with Microsoft Entra ID](fido2-compatibility.md).
33
+
34
+> [!NOTE]
35
+> If you grant the **Require device to be marked as compliant** control as part of a Conditional Access policy, it doesn't block Microsoft Authenticator app access to the UserAuthenticationMethod.Read scope. Authenticator needs access to the UserAuthenticationMethod.Read scope during Authenticator registration to determine which credentials a user can configure. Authenticator needs access to UserAuthenticationMethod.ReadWrite to register credentials, which doesn't bypass the **Require device to be marked as compliant** check.
3336
3437
## Enable passkeys in Authenticator in the admin center
3538
⋯ 160 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.