System-preferred authentication now picks the first factor too

System-preferred, first factor included

System-preferred authentication has been choosing the strongest second factor a user has registered for a while. It now applies to the first factor as well, in the Microsoft-managed state. Entra looks at the user's registered credentials and picks the highest-ranked method for each step.

In practice, a user with a passkey can be offered the passkey straight away and sign in without typing a password. Nothing changes for users who only have a password and a weaker second factor.

Passkeys in registration campaigns

The registration campaign (the "nudge" that prompts users at sign-in to set up a better method) can now target passkeys. That's the easiest way to drive adoption at scale: users are prompted at sign-in, can register in a minute, and IT doesn't have to chase anyone by email. The initial rollout is optimised for users in a passkey profile without restrictions.

What to check

• Is your tenant Microsoft-managed? The first-factor change only applies in the Microsoft-managed state. If you've explicitly disabled system-preferred authentication, you won't see it.
• Tell the service desk. Users suddenly not being asked for a password will generate a few "is this safe?" calls.
• Plan the campaign. Decide who's in scope, whether users can snooze and for how long, and communicate before switching it on.

What users actually see

• Users with a passkey are offered it straight away. Many will never type a password again.
• Users with Authenticator but no passkey still enter a password, then get the strongest second factor they have.
• Users with only a password and SMS see no change, except the registration campaign nudging them to add something stronger.

A user can still choose another method from the "Other ways to sign in" link. System-preferred changes the default, not the options.

Measuring progress

The Authentication methods activity report in the Entra admin center shows how many users are registered for each method and which methods they actually use to sign in. Watch the passwordless-capable percentage climb as the campaign runs.