Learn how to register passkeys in Microsoft Authenticator on Android and iOS. Sign in to the app, use Security info, or register cross-device.
Day in brief
Conditional Access enforcement completes as Entra expands passkey guidance
7 July is primarily a documentation and service-behavior update rather than a broad feature-launch day. Microsoft reports completion of the Conditional Access enforcement update for policies with resource exclusions. The main documentation theme is passkeys: synced-passkey workflows were added, Windows Hello-based Microsoft Entra passkey guidance was expanded but remains explicitly in preview, and Authenticator troubleshooting now documents a potential Conditional Access loop. Microsoft Entra External ID also gained a new Amazon Cognito migration guide. No supplied item announces general availability, and the two removed passkey pages do not by themselves establish retirement of the underlying capability.
- Conditional Access enforcement for resource-exclusion policies is complete
Entra ID · Conditional AccessThe Microsoft 365 Message Center records the Conditional Access enforcement update for policies with resource exclusions as completed in the tenant. This is a completed service-behavior notification, not a documentation change; the supplied summary does not specify the enforcement semantics or a required administrator action.
- Synced-passkey enablement guidance is now documented
Entra ID · AuthenticationA new Microsoft Learn article covers how to configure, register, and sign in with synced passkeys in Microsoft Entra ID. It gives administrators a consolidated workflow reference, but the evidence describes a documentation addition rather than a new feature launch, availability change, or general-availability announcement.
- Windows Hello-based Microsoft Entra passkey guidance expands, still as previewEntra ID · Authentication
The updated enablement material describes Microsoft Entra passkey on Windows, using Windows Hello as a FIDO2 passkey provider for phishing-resistant work or school account sign-in; new registration and sign-in pages accompany it. The explicit preview label means these changes should be treated as preview guidance rather than evidence of GA.
- Authenticator passkey troubleshooting documents a Conditional Access loop
External ID · Conditional AccessUpdated External ID troubleshooting guidance warns that organizations deploying passkeys can encounter a loop when a Conditional Access policy requires phishing-resistant authentication for All resources and a user attempts to add a passkey to Microsoft Authenticator. The page points to workarounds, making this an actionable enrollment and security-guidance change rather than a stated change to Conditional Access behavior.
- External ID adds Amazon Cognito migration guidance
External ID · GeneralA new guide provides step-by-step guidance, feature mapping, and validation strategies for migrating from Amazon Cognito to Microsoft Entra External ID. This is planning and documentation support; the supplied evidence does not indicate an automated migration tool or a change in product availability.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
21 updates
Microsoft Entra ID
19 updatesLearn how to enable passwordless security key sign-in to Windows with Microsoft Entra ID using FIDO2 security keys.
Learn how to register a passkey with a FIDO2 security key in Microsoft Entra ID. Use Security info or a prompted sign-in flow.
Learn about mandatory multifactor authentication (MFA) enforcement for Azure, Microsoft 365, and other admin portals, and how to prepare your tenant.
Learn how to sign in to Microsoft Entra ID with a FIDO2 security key. Sign in to web apps, Windows, and on-premises resources.
Learn how Microsoft Entra passkey on Windows enables phishing-resistant authentication with work or school accounts by using Windows Hello as a FIDO2 passkey provider.
Learn how to register a Microsoft Entra passkey on Windows by using Windows Hello as a FIDO2 passkey provider for phishing-resistant sign-in.
Learn how to sign in with a Microsoft Entra passkey on Windows by using Windows Hello as a FIDO2 passkey provider for phishing-resistant authentication.
Learn about Authenticator-specific requirements, configuration, and troubleshooting for passkeys in Microsoft Authenticator for Microsoft Entra ID.
Learn about synced passkeys in Microsoft Entra ID, including how to configure, register, and sign in with synced passkeys.
Learn how to register a synced passkey (FIDO2) as an authentication method on Windows, iOS, or Android by using a browser for phishing-resistant sign-in.
Learn how to sign in to Microsoft Entra ID with a synced passkey (FIDO2) for your work or school account by using a browser on Windows, iOS, or Android.
Learn how to sign in with passkeys in Microsoft Authenticator for Android and iOS. Use same-device, cross-device, or native app authentication.
Register Passkey Mobile
RemovedA Microsoft Entra documentation page was updated: Register Passkey Mobile.
A Microsoft Entra documentation page was updated: Support Authenticator Passkey.
ai-usage: ai-assisted
* [Federated MFA](/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa)
Primary Refresh Token
Updated| **Term** | **Description** |
With Privileged Identity Management (PIM) for Groups, you can provide just-in-time access to groups in Snowflake and reduce the number of users who have permanent access to privileged groups in Snowflake.
Microsoft Entra External ID
2 updatesTroubleshoot
UpdatedOrganizations that are deploying passkeys and have Conditional Access policies that require phishing-resistant authentication when accessing **All resources (formerly 'All cloud apps')** can run into a looping issue when users attempt to add a passkey to Microsoft Authenticator. For more information and possible workarounds, see [Workarounds for an authentication strength Conditional Access policy loop](~/identity/authentication/how-to-enable-authenticator-passkey.md#workarounds-for-an-authentication-strength-conditional-access-policy-loop).
Learn to migrate from Amazon Cognito to Microsoft Entra External ID with step-by-step guidance, feature mapping, and validation strategies.