MC1450134 High
(Updated) Microsoft Entra: Windows Hello for Business and macOS Platform SSO as standalone MFA factors
Summary AI-generated
Microsoft Entra will recognize Windows Hello for Business and macOS Platform Single Sign-On as standalone MFA factors, reducing reliance on additional passkeys and enhancing phishing-resistant authentication.
Suggested actions AI-generated
- Update onboarding guidance to ensure users register at least one portable MFA method
- Consider requiring users to register a synced passkey or Microsoft Authenticator passkey
- Review custom Authentication Strength policies for WHfB and macOS PSSO
- Update user documentation on new MFA registration behavior
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1450133 Microsoft Entra: Users can register a passkey or passwordless sign-in as their first multifactor authentication method
- MC1247893 (Updated) Microsoft Entra passkeys on Windows now support phishing-resistant sign-in
- MC1326253 Conditional Access policies now apply to Windows Hello for Business and macOS Platform SSO registration
- MC1411574 (Updated) Microsoft Entra: System-preferred authentication now applies to first-factor authentication
- MC1437671 (Updated) Microsoft Entra: Allow password change after secure sign-in with My Sign-Ins
- MC1282568 (Updated) General Availability: Microsoft Entra passkeys on Windows
Original post from Microsoft
Updated October 13, 2026: We have updated the timeline. Thank you for your patience.
[What and why]
Microsoft Entra will soon recognize Windows Hello for Business (WHfB) and macOS Platform Single Sign-On (PSSO) as standalone multifactor authentication (MFA) factors in supported authentication scenarios.
Today, WHfB and macOS PSSO can satisfy MFA requirements during primary sign-in, but users may still be required to register and use an additional passkey or authentication method for certain step-up authentication prompts, Authentication Strength policies, and sign-in frequency checks.
After this rollout, users who authenticate with WHfB or macOS PSSO will be able to satisfy supported MFA requirements without registering an additional passkey. This change helps organizations expand the use of phishing-resistant authentication methods and reduce reliance on less secure authentication methods. As part of this change, a user's WHfB and macOS PSSO credentials will be displayed in My Security Info as auto-registered passkeys.
[Rollout schedule]
- General Availability (Worldwide, GCC): Beginning in early October 2026 and expected to complete in mid-December 2026 (previously late November)
[Impact on your organization]
Who is affected
- Organizations using Microsoft Entra ID
- Users who authenticate with Windows Hello for Business
- Users who authenticate with macOS Platform SSO
- Organizations using Conditional Access Authentication Strength policies
Platforms and services
- Microsoft Entra ID
- Windows Hello for Business
- macOS Platform SSO
- Conditional Access
- Authentication Strength policies
What will happen
After rollout:
- Users signing in with WHfB or macOS PSSO can complete supported MFA challenges without requiring a separate passkey.
- WHfB and macOS PSSO will satisfy supported MFA requirements for step-up authentication scenarios.
- WHfB and macOS PSSO can be used during 2FA to satisfy supported Authentication Strength policy requirements.
- WHfB and macOS PSSO can be used during 2FA to satisfy supported sign-in frequency challenge requirements.
- Users whose only MFA method is WHfB or macOS PSSO will be considered MFA-capable.
- Users who sign in with only a password will no longer be automatically prompted to register an additional MFA method if WHfB or macOS PSSO is their only registered MFA credential.
- Users with WHfB or macOS PSSO credentials, will be able to see them listed in My Security Info as auto-registered passkeys.
[Action required and recommendations]
No configuration changes are required.
We recommend reviewing user onboarding and MFA registration processes before rollout. Because WHfB and macOS PSSO credentials are device-bound, users may not be able to complete MFA challenges from devices where those credentials are not available.
Recommended actions:
- Update onboarding guidance to ensure users register at least one portable MFA method.
- Consider requiring users to register a synced passkey or Microsoft Authenticator passkey in addition to WHfB or macOS PSSO.
- Review custom Authentication Strength policies to confirm WHfB and macOS PSSO are allowed where appropriate.
- Update user documentation because users with only WHfB or macOS PSSO registered will no longer be automatically guided to register an additional MFA method.
Learn more (To be updated closer to GA rollout.)
- Plan a Windows Hello for Business deployment | Security | Windows | Microsoft Learn
- Prepare users to provision and use Windows Hello for Business | Security | Windows | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Additional details from Microsoft
- Summary
- Microsoft Entra will recognize Windows Hello for Business and macOS Platform SSO as standalone MFA factors starting early October 2026, allowing users to meet MFA requirements without additional passkeys. No configuration changes are needed, but organizations should update onboarding and MFA registration guidance accordingly.