*For this entry exists the more relevant or more recent entry MC1253746
check before: 2026-03-01
Product:
Entra
Platform:
Online, US Instances, World tenant
Status:
Change type:
Admin impact, New feature, Updated message, User impact
Links:
Details:
Summary:
Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing configurations migrate to a Default passkey profile with a new passkeyType property. Microsoft-managed registration campaigns will update, prompting users for passkey registration post-MFA.
Details:
Updated March 13, 2026: We have updated the content. Thank you for your patience.
[Introduction]
Starting in March 2026, Microsoft Entra ID will introduce passkey profiles and synced passkeys to General Availability (GA). This update allows administrators to opt in to a new passkey profiles experience that supports group-based passkey configurations and introduces a new passkeyType property.
Important: Only tenants that already have Passkeys (FIDO2) enabled are affected by this update.
The passkeyType property enables admins to configure:
Device-bound passkeys
Synced passkeys
Both
If your tenant already has Passkeys (FIDO2) enabled and you do not opt in to passkey profiles during the initial rollout window, your tenant will be automatically migrated to the passkey profiles schema at the date range specified below. When this occurs:
Existing Passkey (FIDO2) authentication method configurations will be moved into a Default passkey profile.
The passkeyType value will be set based on the tenant's current attestation settings. Synced passkeys will be enabled for tenants with attestation enforcement disabled.
No new authentication methods are enabled as part of this migration.
This migration also impacts Authentication methods registration campaign set to "Microsoft managed" state, which uses passkey configuration settings to determine which registration prompts are shown to users.
Authentication Methods Registration Campaign changes (Microsoft-Managed Only)
Tenants are impacted when all the following conditions are met:
The Passkeys (FIDO2) authentication method policy is Enabled
Authentication methods registration campaign is set to "Microsoft managed" state
Allow self-service setup is Enabled
Target specific AAGUIDs is not selected (no AAGUID restrictions configured)
The Authentication Methods Registration Campaign state is set to Microsoft-managed
For these tenants, Microsoft-managed registration campaign settings will be updated after passkey profile automatic migration is complete. We will roll out changes incrementally to in-scope tenants according to the timeline outlined below.
[When this will happen]
Passkey profile and Synced passkeys General Availability
Public cloud Worldwide: Rollout begins in early March 2026 and is expected to complete by late March 2026
GCC, GCC High, DoD clouds: Rollout begins in early April 2026 and is expected to complete by late April 2026
Automatic migration for existing passkeys (FIDO2) enabled tenants
Public cloud Worldwide: Rollout begins in early April 2026 and is expected to complete by late May 2026
GCC, GCC High, DoD clouds: Rollout begins in early June 2026 and is expected to complete by late June 2026
Authentication Methods registration campaign changes in Microsoft-Managed state (for in-scope tenants):
Public cloud Worldwide: Rollout begins in early April 2026 and is expected to complete by late May 2026
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2026-01-23
updated:
2026-03-17
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
XXXXXXX ... free basic plan only
Direct effects for Operations**
Please, look at the most relevant linked item for details
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2026-03-17 | MC prepare | If you want a configuration different from the migration defaults, review the timeline above and opt in to passkey profiles before your tenant's automatic enablement window begins. Then configure the Default passkey profile's passkeyType to your preferred values.
We also recommend: Review your registration campaign configuration, especially if its set to Microsoft-managed. If you want synced passkeys enabled in your tenant but do not want registration campaign to target passkeys, you can: Switch the registration campaign state to Enabled and continue targeting Microsoft Authenticator, or Set the registration campaign state to Disabled. Update runbooks and help content so your help desk and end users understand any changes in passkey availability or behavior. Learn more: How to Enable Passkey (FIDO2) Profiles in Microsoft Entra ID (preview) - Microsoft Entra ID | Microsoft Learn How to Enable Synced Passkeys (FIDO2) in Microsoft Entra ID (preview) - Microsoft Entra ID | Microsoft Learn How to run a registration campaign to set up Microsoft Authenticator - Microsoft Entra ID | Microsoft Learn Synced passkeys FAQ - Microsoft Entra ID | Microsoft Learn [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization. https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkey-profiles https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-synced-passkeys https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-registration-campaign https://learn.microsoft.com/entra/identity/authentication/synced-passkey-faq | If you want a configuration different from the migration defaults, review the timeline above and opt in to passkey profiles before your tenant's automatic enablement window begins. Then configure the Default passkey profile's passkeyType to your preferred values.
We also recommend: Review your registration campaign configuration, especially if its set to Microsoft-managed. If you do not want registration campaign to target passkeys, you can: Switch the registration campaign state to Enabled and continue targeting Microsoft Authenticator, or Set the registration campaign state to Disabled. Update runbooks and help content so your help desk and end users understand any changes in passkey availability or behavior. Learn more: Enable passkeys for your organization - Microsoft Entra ID | Microsoft Learn How to Enable Passkey (FIDO2) Profiles in Microsoft Entra ID (preview) - Microsoft Entra ID | Microsoft Learn How to Enable Synced Passkeys (FIDO2) in Microsoft Entra ID (preview) - Microsoft Entra ID | Microsoft Learn Synced passkeys FAQ - Microsoft Entra ID | Microsoft Learn [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization. https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-passkey-profiles https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-synced-passkeys https://learn.microsoft.com/entra/identity/authentication/how-to-enable-passkey-fido2#enable-passkey-fido2-authentication-method https://learn.microsoft.com/entra/identity/authentication/synced-passkey-faq |
| 2026-03-17 | MC Summary | Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing configurations migrate to a Default passkey profile with a new passkeyType property. Automatic migration occurs April–May 2026 (worldwide) and June 2026 (GCC/DoD). Admins can opt in early to customize settings. | Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing configurations migrate to a Default passkey profile with a new passkeyType property. Microsoft-managed registration campaigns will update, prompting users for passkey registration post-MFA. |
| 2026-03-17 | MC Last Updated | 03/02/2026 19:05:11 | 2026-03-13T23:26:49Z |
| 2026-03-17 | MC Messages | Updated March 2, 2026: We have updated the content. Thank you for your patience.
[Introduction] Starting in March 2026, Microsoft Entra ID will introduce passkey profiles and synced passkeys to General Availability (GA). This update allows administrators to opt in to a new passkey profiles experience that supports group-based passkey configurations and introduces a new passkeyType property. Important: Only tenants that already have Passkeys (FIDO2) enabled are affected by this update. The passkeyType property enables admins to configure: Device-bound passkeys Synced passkeys Both If your tenant already has Passkeys (FIDO2) enabled and you do not opt in to passkey profiles during the initial rollout window, your tenant will be automatically migrated to the passkey profiles schema at the date range specified below. When this occurs: Existing Passkey (FIDO2) authentication method configurations will be moved into a Default passkey profile. The passkeyType value will be set based on the tenant's current attestation settings. For tenants that have synced passkeys enabled, Microsoft-managed registration campaigns will update to target passkeys. No new authentication methods are enabled as part of this migration. [When this will happen] General Availability (Worldwide): Rollout begins in early March 2026 and is expected to complete by late March 2026. Automatic migration for existing Passkeys (FIDO2) enabled tenants (Worldwide): Rollout begins in early April 2026 and is expected to complete by late May 2026. General Availability (GCC, GCC High, and DoD): Rollout begins in early April 2026 and is expected to complete by late April 2026. Automatic migration for existing Passkeys (FIDO2) enabled tenants (GCC, GCC High, and DoD): Rollout begins in early June 2026 and is expected to complete by late June 2026. | Updated March 13, 2026: We have updated the content. Thank you for your patience.
[Introduction] Starting in March 2026, Microsoft Entra ID will introduce passkey profiles and synced passkeys to General Availability (GA). This update allows administrators to opt in to a new passkey profiles experience that supports group-based passkey configurations and introduces a new passkeyType property. Important: Only tenants that already have Passkeys (FIDO2) enabled are affected by this update. The passkeyType property enables admins to configure: Device-bound passkeys Synced passkeys Both If your tenant already has Passkeys (FIDO2) enabled and you do not opt in to passkey profiles during the initial rollout window, your tenant will be automatically migrated to the passkey profiles schema at the date range specified below. When this occurs: Existing Passkey (FIDO2) authentication method configurations will be moved into a Default passkey profile. The passkeyType value will be set based on the tenant's current attestation settings. Synced passkeys will be enabled for tenants with attestation enforcement disabled. No new authentication methods are enabled as part of this migration. This migration also impacts Authentication methods registration campaign set to "Microsoft managed" state, which uses passkey configuration settings to determine which registration prompts are shown to users. Authentication Methods Registration Campaign changes (Microsoft-Managed Only) Tenants are impacted when all the following conditions are met: The Passkeys (FIDO2) authentication method policy is Enabled Authentication methods registration campaign is set to "Microsoft managed" state Allow self-service setup is Enabled Target specific AAGUIDs is not selected (no AAGUID restrictions configured) The Authentication Methods Registration Campaign state is set to Microsoft-managed For these tenants, Microsoft-managed registration campaign settings will be updated after passkey profile automatic migration is complete. We will roll out changes incrementally to in-scope tenants according to the timeline outlined below. [When this will happen] Passkey profile and Synced passkeys General Availability Public cloud Worldwide: Rollout begins in early March 2026 and is expected to complete by late March 2026 GCC, GCC High, DoD clouds: Rollout begins in early April 2026 and is expected to complete by late April 2026 Automatic migration for existing passkeys (FIDO2) enabled tenants Public cloud Worldwide: Rollout begins in early April 2026 and is expected to complete by late May 2026 GCC, GCC High, DoD clouds: Rollout begins in early June 2026 and is expected to complete by late June 2026 Authentication Methods registration campaign changes in Microsoft-Managed state (for in-scope tenants): Public cloud Worldwide: Rollout begins in early April 2026 and is expected to complete by late May 2026 |
| 2026-03-17 | MC Title | Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants | (Update)Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants |
| 2026-03-17 | MC How Affect | Who is affected: Microsoft Entra ID tenants with Passkeys (FIDO2) enabled
What will happen: If you have not opted in to passkey profiles by your automatic enablement period, your tenant will be migrated to passkey profiles. Your existing Passkey (FIDO2) configurations will be migrated into a Default passkey profile New passkeyType property will be auto-populated If enforce attestation is enabled, then device-bound allowed If enforce attestation is disabled, then device-bound and synced allowed Any existing key restrictions will remain intact Any existing user targets will be assigned to the Default passkey profile [Registration Campaign behavior (Microsoft-managed campaigns only)] For tenants where synced passkeys are enabled, if your registration campaign is set to Microsoft-managed: The targeted authentication method will be updated from Microsoft Authenticator to passkeys. The default user targeting will be updated from voice call or text message users to all multifactor authentication (MFA) capable users. The settings Limited number of snoozes and Days allowed to snooze will no longer be configurable. These will be set to allow unlimited snoozes with a one-day reminder cadence. | Automatic migration for existing passkeys (FIDO2) enabled tenants
What will happen: If you have not opted in to passkey profiles by your automatic enablement period, your tenant will be migrated to passkey profiles. Your existing Passkey (FIDO2) configurations will be migrated into a Default passkey profile New passkeyType property will be auto-populated If enforce attestation is enabled, then device-bound allowed If enforce attestation is disabled, then device-bound and synced allowed Any existing key restrictions will remain intact Any existing user targets will be assigned to the Default passkey profile Authentication Methods registration campaign changes in Microsoft-Managed state (for in-scope tenants) What will happen: Microsoft-managed registration campaign settings will be updated: "Targeted authentication method" will change from Microsoft Authenticator to "passkeys (FIDO2)". "Days allowed to snooze" setting will change from 3days to "1 day". This setting will no longer be configurable. "Limited number of snoozes" setting will change from Enabled to "Disabled". This setting will no longer be configurable. The default user targeting will be updated from voice call or text message users to all multifactor authentication (MFA) capable users. What is the end user impact: Once the above changes have taken effect, users targeted in the registration campaign will begin to receive passkey registration nudges during sign-in flows after they have completed multifactor authentication. |
| 2026-03-03 | MC MessageTagNames | New feature, User impact, Admin impact | Updated message, New feature, User impact, Admin impact |
| 2026-03-03 | MC Summary | Starting March 2026, Microsoft Entra ID will auto-enable passkey profiles with a new passkeyType property for device-bound and synced passkeys. Tenants not opting in will be migrated automatically, with existing settings preserved. Microsoft-managed registration campaigns will update targeting to passkeys. Preparation and configuration before rollout are recommended. | Starting March 2026, Microsoft Entra ID will GA passkey profiles and synced passkeys for tenants with Passkeys (FIDO2) enabled. Existing configurations migrate to a Default passkey profile with a new passkeyType property. Automatic migration occurs April–May 2026 (worldwide) and June 2026 (GCC/DoD). Admins can opt in early to customize settings. |
| 2026-03-03 | MC Last Updated | 01/23/2026 01:55:10 | 2026-03-02T19:05:11Z |
| 2026-03-03 | MC Messages | [Introduction]
Starting in March 2026, Microsoft Entra ID will introduce passkey profiles and synced passkeys to General Availability (GA). This update allows administrators to opt in to a new passkey profiles experience that supports group-based passkey configurations and introduces a new passkeyType property. The passkeyType property enables admins to configure: Device-bound passkeys Synced passkeys Both If a tenant does not opt in to passkey profiles during the initial rollout window, the new schema will be automatically enabled at the date range specified below. When this occurs: Existing Passkey (FIDO2) authentication method configurations will be moved into a Default passkey profile. The passkeyType value will be set based on the tenant's current attestation settings. For tenants that have synced passkeys enabled, Microsoft-managed registration campaigns will update to target passkeys. [When this will happen] General Availability (Worldwide): Rollout begins in early March 2026 and is expected to complete by late March 2026. Automatic enablement for tenants that have not yet opted in (Worldwide): Rollout begins in early April 2026 and is expected to complete by late May 2026. General Availability (GCC, GCC High, and DoD): Rollout begins in early April 2026 and is expected to complete by late April 2026. Automatic enablement for tenants that have not yet opted in (GCC, GCC High, and DoD): Rollout begins in early June 2026 and is expected to complete by late June 2026. | Updated March 2, 2026: We have updated the content. Thank you for your patience.
[Introduction] Starting in March 2026, Microsoft Entra ID will introduce passkey profiles and synced passkeys to General Availability (GA). This update allows administrators to opt in to a new passkey profiles experience that supports group-based passkey configurations and introduces a new passkeyType property. Important: Only tenants that already have Passkeys (FIDO2) enabled are affected by this update. The passkeyType property enables admins to configure: Device-bound passkeys Synced passkeys Both If your tenant already has Passkeys (FIDO2) enabled and you do not opt in to passkey profiles during the initial rollout window, your tenant will be automatically migrated to the passkey profiles schema at the date range specified below. When this occurs: Existing Passkey (FIDO2) authentication method configurations will be moved into a Default passkey profile. The passkeyType value will be set based on the tenant's current attestation settings. For tenants that have synced passkeys enabled, Microsoft-managed registration campaigns will update to target passkeys. No new authentication methods are enabled as part of this migration. [When this will happen] General Availability (Worldwide): Rollout begins in early March 2026 and is expected to complete by late March 2026. Automatic migration for existing Passkeys (FIDO2) enabled tenants (Worldwide): Rollout begins in early April 2026 and is expected to complete by late May 2026. General Availability (GCC, GCC High, and DoD): Rollout begins in early April 2026 and is expected to complete by late April 2026. Automatic migration for existing Passkeys (FIDO2) enabled tenants (GCC, GCC High, and DoD): Rollout begins in early June 2026 and is expected to complete by late June 2026. |
| 2026-03-03 | MC Title | Microsoft Entra ID: Auto-enabling passkey profiles | Microsoft Entra ID: General Availability of passkey profiles and migration for existing Passkeys (FIDO2) tenants |
| 2026-03-03 | MC How Affect | Who is affected: All Microsoft Entra ID tenants
What will happen: If you have not opted in to passkey profiles by your automatic enablement period, your tenant will be migrated to passkey profiles. Your existing Passkey (FIDO2) configurations will be migrated into a Default passkey profile New passkeyType property will be auto-populated If enforce attestation is enabled, then device-bound allowed If enforce attestation is disabled, then device-bound and synced allowed Any existing key restrictions will remain intact Any existing user targets will be assigned to the Default passkey profile [Registration Campaign behavior (Microsoft-managed campaigns only)] For tenants where synced passkeys are enabled, if your registration campaign is set to Microsoft-managed: The targeted authentication method will be updated from Microsoft Authenticator to passkeys. The default user targeting will be updated from voice call or text message users to all multifactor authentication (MFA) capable users. The settings Limited number of snoozes and Days allowed to snooze will no longer be configurable. These will be set to allow unlimited snoozes with a one-day reminder cadence. | Who is affected: Microsoft Entra ID tenants with Passkeys (FIDO2) enabled
What will happen: If you have not opted in to passkey profiles by your automatic enablement period, your tenant will be migrated to passkey profiles. Your existing Passkey (FIDO2) configurations will be migrated into a Default passkey profile New passkeyType property will be auto-populated If enforce attestation is enabled, then device-bound allowed If enforce attestation is disabled, then device-bound and synced allowed Any existing key restrictions will remain intact Any existing user targets will be assigned to the Default passkey profile [Registration Campaign behavior (Microsoft-managed campaigns only)] For tenants where synced passkeys are enabled, if your registration campaign is set to Microsoft-managed: The targeted authentication method will be updated from Microsoft Authenticator to passkeys. The default user targeting will be updated from voice call or text message users to all multifactor authentication (MFA) capable users. The settings Limited number of snoozes and Days allowed to snooze will no longer be configurable. These will be set to allow unlimited snoozes with a one-day reminder cadence. |
Last updated 4 weeks ago ago
