Guidance changes

Week of 26 Oct 2026

1. Entra Passkeys in Microsoft Authenticator

   Watch

   May need admin actionCheck whether new requirements apply to your setup; check the roles and permissions you grant; check the dates against your plans.

   Changed article references · 1 added · 0 removed

   • Added link: exclude the Microsoft Authenticator Credential Registration resource#workarounds-for-an-authentication-strength-conditional-access-policy-loop

   2 new passages (about 170 words), 1 edited passage (1 word changed), 1 removed passage (about 80 words).

   Changed in: Workarounds for an authentication strength Conditional Access policy loop · Users who can't register passkeys because of Require approved client app or Require app protection policy Conditional Access grant controls

   Changed wording view

   Inline diff Before After

   [added: You can exclude the Microsoft Authenticator Credential Registration resource from the Conditional Access policy. Note The Microsoft Authenticator Credential Registration resource will be available in November 2026. Before you can exclude the resource from a Conditional Access policy, you must provision the Microsoft Authenticator Credential Registration enterprise application in your tenant. As a Cloud Application Administrator or Application Administrator: Manually provision the Microsoft Authenticator Credential Registration app by using one of the supported methods for creating an enterprise application from a multitenant app. Use the following details: App ID: 6aa00308-ea33-4caa-90d6-ae905d8cb51b Required role: Cloud Application Administrator or Application Administrator For example, use Microsoft Graph Explorer to make a POST request to https://graph.microsoft.com/v1.0/servicePrincipals with the following body: { "appId": "6aa00308-ea33-4caa-90d6-ae905d8cb51b" } After you provision the app, Microsoft Authenticator Credential Registration appears as a resource in Conditional Access. Exclude it from any Conditional Access policies scoped to All resources to unblock passkey registration in Microsoft Authenticator.]

   Before: No saved wording on this side.

   After: You can exclude the Microsoft Authenticator Credential Registration resource from the Conditional Access policy. Note The Microsoft Authenticator Credential Registration resource will be available in November 2026. Before you can exclude the resource from a Conditional Access policy, you must provision the Microsoft Authenticator Credential Registration enterprise application in your tenant. As a Cloud Application Administrator or Application Administrator: Manually provision the Microsoft Authenticator Credential Registration app by using one of the supported methods for creating an enterprise application from a multitenant app. Use the following details: App ID: 6aa00308-ea33-4caa-90d6-ae905d8cb51b Required role: Cloud Application Administrator or Application Administrator For example, use Microsoft Graph Explorer to make a POST request to https://graph.microsoft.com/v1.0/servicePrincipals with the following body: { "appId": "6aa00308-ea33-4caa-90d6-ae905d8cb51b" } After you provision the app, Microsoft Authenticator Credential Registration appears as a resource in Conditional Access. Exclude it from any Conditional Access policies scoped to All resources to unblock passkey registration in Microsoft Authenticator.

   Note With [removed: either] [added: any] workaround, users must also satisfy any Conditional Access policy that targets Register security info or they can't register the passkey. If you have other conditions set up with the All resources policies, those conditions must be met when the passkey …

   Before: Note With either workaround, users must also satisfy any Conditional Access policy that targets Register security info or they can't register the passkey. If you have other conditions set up with the All resources policies, those conditions must be met when the passkey …

   After: Note With any workaround, users must also satisfy any Conditional Access policy that targets Register security info or they can't register the passkey. If you have other conditions set up with the All resources policies, those conditions must be met when the passkey …

   2 more changed passages · see them all

   Microsoft's commit: Merge pull request #14558 from tilarso/docs/migrate-passkey-pr-2124

   Observed 28 Oct 23:20 UTC · current page · MIT

Quoted wording: © Microsoft Corporation · source and applicable license beside each change.