Microsoft Entra: Enablement of Passkeys in Authenticator for passkey (FIDO2) organizations with no key restrictions
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Action date
Schedule dates changed in the text
Date phrases in schedule sentences differ between the versions we saw- Seen 24 Jan 2025
mid-January 2025→ late January 2025
Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.
What the notice says
Microsoft’s text, safely structuredBeginning late January 2025 (previously mid-January), after the General Availability of passkeys in the Microsoft Authenticator app, organizations with the passkey (FIDO2) authentication methods policy enabled with no key restrictions will be enabled for passkeys in the Microsoft Authenticator app in addition to FIDO2 security keys. This update aligns with the broader availability of passkeys in Entra ID, extending from device-bound passkeys on security keys to device-bound passkeys also on user devices. Users who navigate to aka.ms/MySecurityInfo will see "Passkey in Microsoft Authenticator" as an authentication method they can add. Additionally, when Conditional Access (CA) authentication strengths policy is used to enforce passkey authentication, users who don't yet have any passkey will be prompted inline to register passkeys in Authenticator to meet the CA requirements. If an organization prefers not to enable this change for their users, they can work around it by enabling key restrictions in the passkey (FIDO2) policy. This change will not impact organizations with existing key restrictions or organizations that have not enabled the passkey (FIDO2) policy.
When this will happen
General Availability (Worldwide, GCC, GCC High, DoD): Rollout will happen late January 2025 (previously mid-January).
How this will affect your organization
Who will be impacted: Organizations with the passkey (FIDO2) authentication methods policy enabled with no key restrictions set.
Who will not be impacted: Organizations that do not have the passkey (FIDO2) authentication methods policy enabled and organizations that have the passkey (FIDO2) authentication methods policy enabled and have key restrictions set.
What you need to do to prepare
This rollout will happen automatically with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.
What changed
Between archive captures, newest first- Tags
Admin impact→ Updated message, Admin impact
Beginning
mid-January 2025,late January 2025 (previously mid-January), after the General Availability of passkeys in the Microsoft Authenticator app, organizations … will happen: General Availability (Worldwide, GCC, GCC High, DoD): Rollout will happenmid-January 2025.late January 2025 (previously mid-January). How this will affect your organization: Who will be impacted: Organizations with …- Tags
- · first version seen
Related public changes
- Public source · 9 Nov 2026MC1545694: Microsoft Entra: Updated passkey registration experience in My Sign-ins Microsoft 365 Message Center Archive by Merill Fernando
- Public source · 5 Nov 2026MC1540327: Action required: Prepare users who can’t use passkeys for SMS and voice retirement Microsoft 365 Message Center Archive by Merill Fernando
- Community source · 2 Nov 2026How to secure passkey registration in Entra ID
- Public source · 30 Oct 2026MC1221452: (Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants Microsoft 365 Message Center Archive by Merill Fernando
- Public source · 30 Oct 2026MC1282568: (Updated) General Availability: Microsoft Entra passkeys on Windows Microsoft 365 Message Center Archive by Merill Fernando
- Official documentation · 28 Oct 2026Passkeys in Microsoft Authenticator
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.