MC1450133 – M365 Change Digest

One-line summary

Users can soon register a passkey or passwordless sign-in as their first MFA method, simplifying strong authentication adoption and bypassing weaker SMS/voice registration.

Similar updates

Details

Summary

Users can now register passkeys or passwordless sign-in as their first multifactor authentication method in Microsoft Entra, eliminating the need to set up weaker methods first. This change, rolling out from October 2026 to February 2027, aims to increase adoption of phishing-resistant authentication without requiring admin action.

Body (from Message Center)

Updated August 11, 2026: We have updated the content. Thank you for your patience.

[What and why]

Users will soon be able to register a passkey as their first multifactor authentication method. Previously, people had to set up an alternate MFA method like SMS or Voice before they could add a passkey (FIDO2), Windows Hello for Business, macOS Platform SSO. That extra step pushed users toward weaker methods and slowed the move to phishing-resistant sign-in. Now password-only users can go straight to a passkey, making it easier to adopt strong authentication from day one. As part of this work, we will also be enabling Authenticator App passwordless sign-in to be a user's first registered MFA method.

[Rollout schedule]

This feature will roll out in phases:

Phase 1: Support for synced passkeys, Microsoft Entra passkeys on Windows, and FIDO2 security keys.

General Availability (Worldwide, GCC): We will begin rolling out in mid-October 2026 and expect to complete by mid-November 2026.

Phase 2: Support for Windows Hello for Business, macOS Platform SSO, Authenticator App passkey, and Authenticator App passwordless sign-in.

General Availability (Worldwide, GCC): We will begin rolling out in early January 2026 and expect to complete by late February 2027.

[Impact on your organization]

Who is affected

Users who have not yet registered a multifactor authentication method
Identity and security administrators responsible for authentication onboarding and registration policies

Platforms and services

Microsoft Entra ID
Passkeys (FIDO2)
Windows Hello for Business
macOS Platform SSO
Microsoft Authenticator passwordless sign-in

What will happen

Password-only users will be able to register passkeys or passwordless sign-in as their first MFA method.
Users will no longer need to register a method such as SMS or voice before registering a passkey (FIDO2), Windows Hello for Business, macOS Platform SSO, or Authenticator passwordless sign-in.
Organizations may see reduced registration friction and increased adoption of phishing-resistant authentication methods.

[Action required and recommendations]

No action is required for this change.

We recommend that administrators:

Review Conditional Access policies related to security information registration.
Consider requiring MFA to register security information if additional verification is required by your organization.
Review onboarding and registration guidance so users know to set up a passkey as their preferred first method.

Learn more

(To be updated closer to rollout) Register a synced passkey (FIDO2) | Authentication | Microsoft Entra ID | Microsoft Learn

[Compliance considerations]

Question	Answer
Does the change include an admin control?	Yes. Administrators can control which authentication methods users are allowed to register through existing Microsoft Entra authentication method policies and Conditional Access policies.
Does the change affect access or authentication controls?	Yes. The update changes how users register multifactor authentication methods by allowing eligible users to register supported passkeys or passwordless authentication methods as their first MFA method.
Can administrators govern the feature through existing Microsoft Entra controls?	Yes. Administrators retain control over the feature through Microsoft Entra authentication method policies and Conditional Access configurations.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": "2026-10-15T00:00:00Z",
    "ai_actions": [
      "Review Conditional Access policies for security information registration",
      "Consider requiring MFA to register security information",
      "Review onboarding/registration guidance for passkey setup"
    ],
    "ai_master_tags": [
      "User",
      "Admin",
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Users can soon register a passkey or passwordless sign-in as their first MFA method, simplifying strong authentication adoption and bypassing weaker SMS/voice registration.",
    "ai_topics": [
      "Entra",
      "Authenticator",
      "Windows Hello For Business",
      "Macos Platform Sso"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "Users can now register passkeys or passwordless sign-in as their first multifactor authentication method in Microsoft Entra, eliminating the need to set up weaker methods first. This change, rolling out from October 2026 to February 2027, aims to increase adoption of phishing-resistant authentication without requiring admin action."
    },
    "id": "MC1450133",
    "importance": 3,
    "is_major_change": false,
    "last_modified": "2026-08-11T16:19:53Z",
    "ms_products": [
      "Entra"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Entra"
    ],
    "severity": "normal",
    "tags": [
      "Updated message",
      "New feature",
      "User impact",
      "Admin impact"
    ],
    "title": "Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method"
  }
}