MC1221452 - Microsoft Entra ID: Auto-enabling passkey profiles

Updated July 20, 2026: We have updated the content. Thank you for your patience.

Introduction

Starting in March 2026, Microsoft Entra ID will introduce passkey profiles and synced passkeys to General Availability (GA). This update allows administrators to opt in to a new passkey profiles experience that supports group-based passkey configurations and introduces a new passkeyType property.

Important: Only tenants that already have Passkeys (FIDO2) enabled are affected by this update.

The passkeyType property enables admins to configure:

• Device-bound passkeys
• Synced passkeys
• Both

If youra tenant already has Passkeys (FIDO2) enabled and you dodoes not opt in to passkey profiles during the initial rollout window, your tenantthe new schema will be automatically migrated to the passkey profiles schemaenabled at the date range specified below. When this occurs: 

• Existing Passkey (FIDO2) authentication method configurations will be moved into a Default passkey profile. 
• The passkeyType value will be set based on the tenant’s current attestation settings. Synced passkeys will be enabled for
• For tenants with attestation enforcement disabled.
• No new authentication methods are enabled as part of this migration.
• This migration also impacts Authentication methods registration campaign set to “Microsoft managed” state, which uses passkey configuration settings to determine which registration prompts are shown to users.

Authentication Methods Registration Campaign changes (Microsoft-Managed Only)

Tenants are impacted when all the following conditions are met:

1. The Passkeys (FIDO2) authentication method policy is Enabled
2. Authentication methods registration campaign is set to “Microsoft managed” state
3. Allow self-service setup is Enabled
4. Target specific AAGUIDs is not selected (no AAGUID restrictions configured)
5. The Authentication Methods Registration Campaign state is set to Microsoft-managed
6. The tenant has at least one user enabled for boththat have synced passkeys and device‑bound passkeys
7. Only users who are enabled for both synced passkeys and device‑bound passkeys, with no passkey profile restrictions configured (i.e. attestation enforcement, AAGUID restrictions),enabled, Microsoft-managed registration campaigns will receive a passkey registration nudge during sign‑in.

For these tenants, Microsoft-managed registration campaign settings will be updated after passkey profile automatic migration is complete. We will roll out changes incrementallyupdate to in-scope tenants according to the timeline outlined below.

When this will happen

Passkey profile and Synced passkeys

• General Availability
  1. Public cloud Worldwide, GCC: (Worldwide): Rollout begins in early March 2026 and is expected to complete by late March 2026
  .
  • GCC High, DoD clouds:Automatic enablement for tenants that have not yet opted in (Worldwide): Rollout begins in early MayApril 2026 and is expected to complete by late May 2026.
  2. USNat, USSec:General Availability (GCC, GCC High, and DoD): Rollout begins in early OctoberApril 2026 (previously early July) and is expected to complete by late October 2026 (previously late July)

  April 2026.

  • Automatic migrationenablement for existing passkeys (FIDO2) enabled tenants
    1. Public cloud Worldwide, GCC: that have not yet opted in (GCC, GCC High, and DoD): Rollout begins in early MayJune 2026 and is expected to complete by late June 20262026. 
    2. GCC High, DoD clouds: Rollout begins in early October 2026 (previously early August) and is expected to complete by late October 2026 (previously late August)
• USNat, USSec: Rollout begins in early October 2026 (previously early August) and is expected to complete by late October 2026 (previously late August)

Authentication Methods registration campaign changes in Microsoft-Managed state (for in-scope tenants):

1. Public cloud Worldwide, GCC: Rollout begins in early May 2026 and is expected to complete by late June 2026

How this affects your organization

Automatic migration for existing passkeys (FIDO2) enabledWho is affected: All Microsoft Entra ID tenants

What will happen:

If you have not opted in to passkey profiles by your automatic enablement period, your tenant will be migrated to passkey profiles.

• Your existing Passkey (FIDO2) configurations will be migrated into a Default passkey profile
• New passkeyType property will be auto-populated
• If enforce attestation is enabled, then device-bound allowed
• If enforce attestation is disabled, then device-bound and synced allowed
• Any existing key restrictions will remain intact
• Any existing user targets will be assigned to the Default passkey profile

Authentication MethodsRegistration Campaign behavior (Microsoft-managed campaigns only)

• For tenants where synced passkeys are enabled, if your registration campaign changes inis set to Microsoft-Managed state (for in-scope tenants)

  What will happen:

  Microsoft-managed registration campaign settingsmanaged: 

  • The targeted authentication method will be updated:
    1. "Targeted authentication method” will changeupdated from Microsoft Authenticator to “passkeys (FIDO2)”passkeys.
    2. “Days allowed to snooze” setting will change from 3days to “1 day”. This setting will no longer be configurable.
    3. “Limited number of snoozes” setting will change from Enabled to "Disabled”. This setting will no longer be configurable.
    4. The default user targeting will be updated from voice call or text messageusers to all multifactor authentication (MFA) capable users. 

    What is the end user impact:

    Once the above changes have taken effect, users targeted in the registration campaign

  • The settings Limited number of snoozes and Days allowed to snooze will beginno longer be configurable. These will be set to receive passkey registration nudges during sign-in flows after they have completed multifactor authentication.
    1. 
       allow unlimited snoozes with a one-day reminder cadence.

What you can do to prepare

If you want a configuration different from the migration defaults, review the timeline above and opt in to passkey profiles before your tenant’s automatic enablement window begins. Then configure the Default passkey profile’s passkeyType to your preferred values.

We also recommend:

• Review your registration campaign configuration, especially if its set to Microsoft-managed. If you want synced passkeys enabled in your tenant but do not want registration campaign to target passkeys, you can: 
• Switch the registration campaign state to Enabled and continue targeting Microsoft Authenticator, or 
• Set the registration campaign state to Disabled.
• Update runbooks and help content so your help desk and end users understand any changes in passkey availability or behavior. 

Learn more:

• Enable passkeys for your organization - Microsoft Entra ID | Microsoft Learn
• How to Enable Passkey (FIDO2) Profiles in Microsoft Entra ID (preview) - Microsoft Entra ID | Microsoft Learn
• How to Enable Synced Passkeys (FIDO2) in Microsoft Entra ID (preview) - Microsoft Entra ID | Microsoft Learn
• How to run a registration campaign to set up Microsoft Authenticator - Microsoft Entra ID | Microsoft Learn
• Synced passkeys FAQ - Microsoft Entra ID | Microsoft Learn

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.