Windows Hello for Business and Platform SSO Become Auto-Registered Passkeys in Entra

In this post

What changes
Why it matters
What admins should do
What is not changing
Sources

Microsoft Entra is changing how it treats Windows Hello for Business (WHfB) and macOS Platform SSO (PSSO). Starting early October 2026 and finishing in late November 2026, both credentials count as standalone MFA factors and appear in My Security Info as auto-registered passkeys (Message Center MC1450134).

What changes

After the rollout, a user who signs in with WHfB or macOS PSSO can satisfy supported MFA challenges without registering a separate passkey. Three visible effects follow:

Passkey listing. The user’s WHfB and PSSO credentials show in My Security Info as auto-registered passkeys. No user action or admin configuration is needed.
No extra registration prompt. A user who signs in with only a password, and whose only registered MFA credential is WHfB or PSSO, is no longer automatically prompted to register another MFA method.
Standalone MFA. Entra recognizes both credentials as MFA factors in supported scenarios, including step-up prompts, Authentication Strength policies and sign-in frequency checks.

Why it matters

Until now, WHfB and PSSO could satisfy MFA during primary sign-in. Users could still be forced to register and use an additional passkey or method for certain step-up prompts, Authentication Strength policies and sign-in frequency checks. Those prompts were friction for people who already had a hardware-bound, biometric or PIN-protected credential on the device.

The change removes that second hurdle. Users on managed Windows and Mac devices complete fewer prompts, and help desks field fewer “why am I being asked to register again?” tickets.

What admins should do

Microsoft says no configuration changes are required, but the behavior shift deserves a review before the rollout reaches your tenant.

Check Authentication Strength policies. Confirm each strength permits WHfB and the macOS Platform Credential wherever you intend them to fulfill MFA.
Decide whether one credential is enough. If a device-bound credential as the only recovery path is too thin for your risk model, consider requiring users to also register a synced passkey or a Microsoft Authenticator passkey.
Update user guidance. Users with only WHfB or PSSO will no longer be guided to register an additional MFA method, so onboarding and MFA registration documents should say so.
Review registration controls. Since July 6, 2026, Conditional Access policies targeting the “Register security information” action also apply when users provision WHfB or register PSSO credentials.

What is not changing

“Passkey” is a display label, not a policy switch. Microsoft’s documentation still treats Entra passkey on Windows (a FIDO2 passkey stored in the Windows Hello container) as distinct from WHfB credentials that may be provisioned during device registration. FIDO2 passkeys are governed by passkey profiles; WHfB registration does not follow passkey profile restrictions. A user on a synced-only profile can still register WHfB.
Registration campaigns are platform-aware. A WHfB credential suppresses the passkey nudge on Windows, but not on macOS, and a PSSO credential likewise only covers macOS. Expect nudges to continue on other platforms.
One credential per container. Users cannot register an Entra passkey on Windows if a WHfB credential already exists for the same account and container.
Prerequisites still apply. PSSO remains an Intune-managed deployment, and the Windows Hello MFA documentation notes a passkey (FIDO2) enablement prerequisite. Verify against current Microsoft Learn pages for your scenario.
Timing varies by tenant. The rollout began in early October 2026 and is expected to finish in late November 2026 for Worldwide and GCC, so some tenants will not see the change yet.

The distinction matters in the admin center. Windows Hello passkeys are governed by passkey profiles in Entra ID > Authentication methods, where you add the Windows Hello AAGUIDs to an allowed list. The screenshots below, from Microsoft Learn, show that configuration.

Adding Windows Hello AAGUIDs to a passkey profile. Source: Microsoft Learn. © Microsoft.

Sources

Based on search results retrieved October 24, 2026. Confirm details in your own Message Center before acting.