MC1097225 - Microsoft Entra ID: Upcoming changes to support passkey profiles in the authentication methods policy (preview)

Updated November 5, 2025: We have updated the timeline for Preview and the content below. Thank you for your patience.

In November 2025, we will expand the passkey (FIDO2) authentication methods policy in Microsoft Entra ID to support passkey profiles in public preview. This update will enable granular, group-based control over passkey configurations and introduce new API schema changes.

When this will happen:

Public Preview (Worldwide): We will begin rolling out early November 2025 and expect to complete by late November 2025 (previously early December).

Public Preview (GCC,(Worldwide, GCC, GCC High, DoD): We will begin rolling out mid-NovemberOctober 2025 and expect to complete by mid-DecemberNovember 2025.

We will update this message when the plan for General Availability is finalized.

How this will affect your organization:

After this rollout, you'll be able to apply different passkey configurations per user group. For example, you will be able to:

• Allow the use of specific FIDO2 security key models for user group A
• Allow the use of passkeys in Microsoft Authenticator for user group B

Important: If your organization opts-in tomodifies the new admin UX, a Default passkey profile will automatically be populated with your existing policy configurations. Once you modify and savevia the Default passkey profile,Microsoft Azure or Entra portal during preview, the new schema will take effect. If you continue using Graph API or third-party tools to modify the policy, the schema will not change until General Availability.

These new settings will be available at EntraMicrosoft 365 admin center > Home > Security > Authentication methods > Passkey (FIDO2) settings:

As part of this update in November 2025, if Enforce attestation is disabled, we will start accepting any WebAuthn-compliant security key or passkey providers using the followingprovider when Enforce attestation statements:

• “none” 
• “tpm” 
• “packed” (AttCA type only) 
• Custom attestation formats ≤ 32 characters
• “packed” (self) should be deployed from early January 2026 to early February 2026 

is disabled. This will allow a wider range of security keys and passkey providers to be accepted for registration and authentication in Microsoft Entra ID. To compare this upcoming update with the current behavior, refer to Microsoft Entra ID attestation for FIDO2 security key vendors

What you need to do to prepare:

This rollout will happen automatically by the specified dates with no admin action required before the rollout. You may want to review your current passkey configuration, notify your admins about this change, and update internal documentation.

Learn more about passkeys in Microsoft Entra ID: Enable passkeys for your organization - Microsoft Entra ID | Microsoft Learn (will be updated before rollout)