This article is based on Microsoft’s announcement and on our Microsoft 365 security projects.
What exactly changes
Until now, a user who signed in with only a password had to register another method first, such as SMS or a voice call, before they could add a passkey. That requirement is gone: a passkey can now be the first method. Users enabled for passkeys are offered one by default, including when registration starts because a Conditional Access policy requires MFA.
| Phase | When | What’s included |
|---|---|---|
| 1 | Early November 2026 to early January 2027 | Synced passkeys, Entra passkeys on Windows, FIDO2 security keys |
| 2 | January to late February 2027 | Windows Hello for Business, macOS Platform SSO, passkeys and passwordless sign-in in Microsoft Authenticator |
Organisations that use Security Defaults get the same experience in January–February 2027.
Why it matters
The passkey isn’t the problem: it’s the strongest sign-in method available today. The problem is the moment you register it. If the password of a user who has no MFA yet has leaked, through phishing or a password dump, an attacker can sign in with it and register a passkey on their own device.
A passkey doesn’t depend on the password. So a password reset, the first thing you do when you suspect a breach, doesn’t lock the attacker out: their passkey keeps working until it’s removed from the account.
To be precise, this gap already exists. Before the change, an attacker with the password of a user without MFA could register their own SMS number or authenticator app. The change adds one more way in, which makes now a good time to close the gap altogether.
What to check
- Find users without MFA. In Microsoft Entra’s User registration details report, filter for active users with no method registered. These are exactly the users the change affects. Get them registered in a controlled way, or disable accounts nobody uses.
- Require MFA to register sign-in methods, from every location. Create a Conditional Access policy on the Register security information action, for all member users, that requires MFA from every location. Microsoft’s guide excludes trusted locations; we recommend not excluding them: even in the office, a leaked password shouldn’t be enough to register. Exclude only your emergency (break-glass) accounts, and start in report-only mode.
- Give new employees a Temporary Access Pass. A new employee has no method yet, so they can’t meet the MFA requirement. A Temporary Access Pass is a time-limited code an admin issues, and it satisfies MFA: the employee signs in with it and registers a passkey, without the password alone being enough. TAP doesn’t work for guest users, which is why the policy targets member users only.
Want to check these settings in your tenant? At OnCloud we help organisations secure MFA registration and move to passkeys in an orderly way.
Book a call