ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 271/272 feeds/APIs · 469/469 docs · 7/9 advisories · checked 15:46 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC1097225 Plan for changeMajor changeUpdated messageFeature updateUser impactAdmin impactRetirement

Entra ID: Upcoming changes to support passkey profiles in the authentication methods policy (preview)

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Microsoft Entra
Microsoft 365 admin center

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions this installation saw
  • Seen 5 Nov 2025 early January 2026, early February 2026
  • Seen 5 Nov 2025 early December 2025 → late November 2025
  • Seen 15 Oct 2025 mid-October 2025 → early November 2025, early December 2025, mid-December 2025

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, safely structured

Updated November 5, 2025: We have updated the timeline for Preview and the content below. Thank you for your patience.

In November 2025, we will expand the passkey (FIDO2) authentication methods policy in Microsoft Entra ID to support passkey profiles in public preview. This update will enable granular, group-based control over passkey configurations and introduce new API schema changes.

When this will happen

Public Preview (Worldwide): We will begin rolling out early November 2025 and expect to complete by late November 2025 (previously early December).

Public Preview (GCC, GCC High, DoD): We will begin rolling out mid-November 2025 and expect to complete by mid-December 2025.

How this will affect your organization

After this rollout, you'll be able to apply different passkey configurations per user group. For example, you will be able to:

  • Allow the use of specific FIDO2 security key models for user group A
  • Allow the use of passkeys in Microsoft Authenticator for user group B

Important: If your organization opts-in to the new admin UX, a Default passkey profile will automatically be populated with your existing policy configurations. Once you modify and save the Default passkey profile, the new schema will take effect. If you continue using Graph API or third-party tools to modify the policy, the schema will not change until General Availability.

These new settings will be available at Entra admin center > Home > Security > Authentication methods > Passkey (FIDO2) settings:

As part of this update in November 2025, if Enforce attestation is disabled, we will start accepting security key or passkey providers using the following attestation statements:

  • “none”
  • “tpm”
  • “packed” (AttCA type only)
  • Custom attestation formats ≤ 32 characters
  • “packed” (self) should be deployed from early January 2026 to early February 2026

This will allow a wider range of security keys and passkey providers to be accepted for registration and authentication in Microsoft Entra ID. To compare this upcoming update with the current behavior, refer to Microsoft Entra ID attestation for FIDO2 security key vendors

What you need to do to prepare

This rollout will happen automatically by the specified dates with no admin action required before the rollout. You may want to review your current passkey configuration, notify your admins about this change, and update internal documentation.

Learn more about passkeys in Microsoft Entra ID: Enable passkeys for your organization - Microsoft Entra ID | Microsoft Learn (will be updated before rollout)

What changed

Between archive captures, newest first

  1. Updated November 5, 2025: We have updated the timeline for Preview.Preview and the content below. Thank you for your patience. In November 2025, we will expand the … user group B Important: If your organization opts-in to the new admin UXUX, a Default passkey profile will automatically be populated with your existing policy configurations. Once you modify and modifiessave the Default passkey profile, the new schema will take effect.  If you continue using Graph API or third-party tools to modify the … not change until General Availability. These new settings will be available at Microsoft 365 Entra admin center > Home > Security > Authentication methods > Passkey (FIDO2) … “none”  “tpm”  “packed” (AttCA type only)  Custom attestation formats ≤ 32 characters “packed” (self) should be deployed from early January 2026 to early February 2026  This will allow a wider range of security keys and passkey providers …

  2. Updated October 20,November 5, 2025: We have updated the rollout timelines and content below. timeline for Preview. Thank you for your patience. In November 2025, we will expand the … will begin rolling out early November 2025 and expect to complete by late November 2025 (previously early December 2025.December). Public Preview (GCC, GCC High, DoD): We will begin rolling out mid-November …

  3. Updated October 15,20, 2025: We have updated the rollout timelines and content below. Thank you for your patience. In November 2025, we will expand … passkeys in Microsoft Authenticator for user group B Important: If your organization modifiesopts-in to the passkey policy via the Microsoft Azure or Entra portal during preview, new admin UX and modifies the Default passkey profile, the new schema will take effect. If you continue using Graph API … > Passkey (FIDO2) settings: As part of this update in November 2025, if Enforce attestation is disabled, we will start accepting any WebAuthn-compliant security key or passkey provider when Enforceproviders using the following attestation statements: “none”  “tpm”  “packed” (AttCA type only)  Custom attestation is disabled. formats ≤ 32 characters  This will allow a wider range of security keys and passkey providers …

    • Title Microsoft Entra ID: Upcoming changes to support passkey profiles in the authentication methods policy (preview) → Entra ID: Upcoming changes to support passkey profiles in the authentication methods policy (preview)
    • Tags Feature update, User impact, Admin impact, Retirement → Updated message, Feature update, User impact, Admin impact, Retirement

    Updated October 15, 2025: We have updated the rollout timelines below. Thank you for your patience. In November 2025, we will expand the passkey (FIDO2) authentication methods policy … and introduce new API schema changes. When this will happen: Public Preview (Worldwide, GCC, GCC High, DoD): (Worldwide): We will begin rolling out mid-Octoberearly November 2025 and expect to complete by mid-Novemberearly December 2025. Public Preview (GCC, GCC High, DoD): We will update this message when the plan for General Availability is finalized.begin rolling out mid-November 2025 and expect to complete by mid-December 2025. How this will affect your organization: After this rollout, you'll be able …

  5. · first version seen

Learn more

Links from the notice and their documentation checks

Suggested by a shared curated topic and product; not a verified connection (6 items)

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
  • 2 linked pages have not been read yet.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 27 Oct 15:46 UTC · 271 of 272 readable · 269 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.