Roll out passkeys to a pilot group

Pick 10 to 30 people who use a mix of iPhone, Android and Windows, plus a couple of service desk staff who will support the wider rollout. Put them in a group such as Passkey-Pilot. Decide which passkeys you'll accept. This lab uses device-bound passkeys only: passkeys in Microsoft Authenticator and FIDO2 security keys. Synced passkeys (Apple, Google and password manager passkeys) can't be attested, so treat them as a separate decision.

Passkeys can't be registered by guest users, internal or external.

In the Microsoft Entra admin center, go to Entra ID → Authentication methods → Policies and select Passkey (FIDO2). If you haven't already, select the link in the banner to opt in to passkey profiles. Your existing settings move into a Default passkey profile. You can't opt out afterwards, and up to three profiles are supported, including the default.

On the Configure tab, make sure Allow self-service set up is Yes. With No, users can't add a passkey from Security info even if the method is enabled for them.

On the Configure tab, select + Add passkey profile and fill it in:

Name: Pilot device-bound.

Enforce attestation: Yes. Entra ID then checks at registration that the passkey really comes from the make and model it claims. Two trade-offs to know: attested passkeys in Authenticator must be created in the Authenticator app itself, not through the cross-device (QR code) flow, and attestation relies on Apple and Google services, so registration can occasionally fail and need a retry. Attestation applies only at registration, so turning it on later doesn't block passkeys already registered.

Passkey types: Device-bound only.

Enforce key restrictions: leave off unless you want to allow only certain models. If you do, set the behaviour to Allow and add Microsoft Authenticator plus the AAGUIDs of your security key models. Removing an AAGUID later stops anyone who registered that model from signing in with it.

Select Save.

Select Enable and Target, make sure Enable is on, select Add target, choose Select targets, pick Passkey-Pilot and apply the Pilot device-bound profile. Select Save.

A user in several targets can register any passkey that fully meets at least one of their profiles. A user in an excluded group can't register or sign in with a passkey at all, whatever else they're in.

Registering a passkey needs a recent MFA sign-in (within the last five minutes). Users who only have a password, or who are switching phones, can use a Temporary Access Pass instead. In Authentication methods → Policies, select Temporary Access Pass, enable it for Passkey-Pilot, and under Configure check the lifetimes (a pass lasts 1 hour by default, and the policy can allow up to 30 days) and whether passes are one-time use. Then issue one:

1
2
3
4Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"
$body = @{ lifetimeInMinutes = 60; isUsableOnce = $true }
New-MgUserAuthenticationTemporaryAccessPassMethod -UserId "pilot.user@contoso.com" -BodyParameter $body |
  Select-Object TemporaryAccessPass, LifetimeInMinutes, IsUsableOnce

Or in the portal: Entra ID → Users, select the user, Authentication methods → Add authentication method → Temporary Access Pass. The pass is shown once, so copy it before you close the pane. Authentication Administrators can issue passes to non-admin users; Privileged Authentication Administrator is needed for admins.

With a one-time pass, the user must finish registering the passkey within 10 minutes of signing in. A pass that can be used more than once doesn't have that limit.

Send the pilot users to https://aka.ms/mysecurityinfo. They sign in (with MFA or the Temporary Access Pass), select + Add sign-in method, and choose Passkey in Microsoft Authenticator or the security key option. For Authenticator, the wizard sends them to the app; they add their work account if needed, turn on Authenticator as a passkey provider in the phone's settings when prompted, and return to the browser to finish. On iOS 18 that setting is under Settings → General → Autofill & Passwords.

Users can also start in the Authenticator app itself, which is the only route for attested passkeys. Cross-device registration needs Bluetooth on both devices and network access to the phone platform's relay (cable.ua5v.com for Android, cable.auth.com for iOS).

In Entra ID → Conditional Access → Policies, create a policy:

Users: include Passkey-Pilot, exclude your break-glass accounts. Target resources: start with a few named apps, such as Office 365 and the Azure and admin portals, rather than All resources. A policy on all resources that demands a passkey also applies to the Authenticator app, which can leave users stuck in a loop when they try to add a passkey to it. Grant: Require authentication strength and pick the built-in Phishing-resistant MFA strength. Enable policy: Report-only for the first week.

Users in scope also have to meet any policy that targets the Register security info user action, so check those don't block registration. When the report-only results look clean, switch the policy to On.

Entra ID → Authentication methods → Activity has a Registration tab (who has which method) and a Usage tab (sign-ins by method). The user registration details can take up to 36 hours to update. For a live view of the pilot group, list each member's passkeys:

1
2
3
4
5
6
7
8
9
10Connect-MgGraph -Scopes "GroupMember.Read.All","UserAuthenticationMethod.Read.All"
$g = Get-MgGroup -Filter "displayName eq 'Passkey-Pilot'"
Get-MgGroupMember -GroupId $g.Id -All | ForEach-Object {
  $keys = Get-MgUserAuthenticationFido2Method -UserId $_.Id
  [pscustomobject]@{
    User     = $_.AdditionalProperties.userPrincipalName
    Passkeys = @($keys).Count
    Models   = ($keys.Model | Sort-Object -Unique) -join ", "
  }
} | Sort-Object Passkeys | Format-Table

Anyone with zero is who to follow up with. In the sign-in logs, open a pilot user's sign-in and check the Authentication Details tab and the Conditional Access result for your new policy. Failures there, with the reason, tell you what to fix before you widen the group.

Once the pilot group can sign in without help, add more groups to the profile target and the Conditional Access policy in waves, with a user email before each one. Keep the Temporary Access Pass enabled for the service desk, because it's also how people recover after losing a phone or key.