Deploy passkeys with a registration campaign in Entra ID

You have turned on passkeys in Microsoft Entra ID, but users still have to register one themselves. Asking everyone personally to do that takes a lot of time.

In May 2026, Microsoft made passkeys (FIDO2) generally available as the target of the registration campaign in Entra ID. Microsoft writes that this first rollout is optimized for users in a passkey profile without restrictions. In this blog post you read how to set up a registration campaign for passkeys, what the states do and what your users get to see.

What is a registration campaign?

A registration campaign asks users to set up a stronger authentication method after they have completed an interactive sign-in with multifactor authentication (MFA). You decide which users and groups take part.

The campaign has two target methods: Passkey (FIDO2) and Microsoft Authenticator. A tenant can target only one method at a time.

Conditional Access policies for registering security information apply here too: if a user may do that only on the internal network, they also get the prompt only there.

What do you need?

• An account with at least the Authentication Policy Administrator role.
• The Passkey (FIDO2) method enabled in the Authentication methods policy, with the users of the campaign in scope.
• Allow self-service set up set to Yes in the Passkey (FIDO2) configuration.
• Users who use Microsoft Entra MFA. With another MFA solution the campaign does not work.

Passkeys (FIDO2) are included in all editions of Microsoft Entra ID, including Free, without an extra license.

Choose the state of the campaign

The state determines who chooses the settings.

With Disabled the campaign is off.

In the Microsoft managed state, Microsoft chooses passkeys if the users in the campaign are enabled for passkeys, and otherwise Authenticator, provided they are enabled for it. An Authenticator campaign under Microsoft managed also prompts only users who do MFA with text message or a voice call. For passkeys, a user gets the prompt only if they are in at least one passkey profile that Microsoft considers eligible: without restrictions, only synced passkeys, only device-bound passkeys, an AAGUID allowlist with at least one AAGUID of iCloud Keychain, Google Password Manager, the passkey in Microsoft Authenticator or the Microsoft Entra passkey on Windows, or device-bound with enforced attestation. The Exclude and Block lists do not count here.

The page Protecting authentication methods in Microsoft Entra ID describes a narrower rule: the target method goes to passkeys only if users are in a profile that allows both synced and device-bound passkeys, and with a restriction to specific AAGUIDs the target method stays Authenticator. The pages contradict each other; this blog post follows the page about the registration campaign, which was updated more recently.

💡 Note: if your campaign is set to Microsoft managed, you have enabled passkeys and the users are in an eligible passkey profile, then according to the page Protecting authentication methods, Microsoft changes the settings step by step: the target method goes from Authenticator to passkeys, the snooze duration from 3 to 1 day, the limited number of snoozes is turned off, and all users who can do MFA get the prompt, not only those with text message or voice call.

If you do not want that, or want to decide the snooze settings yourself, choose Enabled. That is also the state for users in a passkey profile that does not count under Microsoft managed: in Enabled, every user who is enabled for passkeys can get the prompt, regardless of their passkey profile.

Prepare passkeys

Without Allow self-service set up, users cannot add a passkey through Security info, even when passkeys are enabled. Check that setting first.

1. Sign in to the Microsoft Entra admin center as at least Authentication Policy Administrator.
2. Navigate to Entra ID > Security > Authentication methods. A separate pane opens; choose Policies in it.

3. Select Passkey (FIDO2). If you do not use passkey profiles yet, first select the link in the banner to turn them on. Your existing settings move to a Default passkey profile; after that you can no longer turn passkey profiles off.
4. On the Configure tab, set Allow self-service set up to Yes.
5. Under Enable and Target, check that the users or groups of your campaign are added as targets.
6. Click Save.

You can read more about passkey profiles and synced and device-bound passkeys in How to enable passkeys (FIDO2) in Microsoft Entra ID.

Configure the registration campaign

1. In the Microsoft Entra admin center, navigate to Entra ID > Security > Authentication methods and choose Registration campaign in the pane that opens. Click Edit if needed.
2. Set State to Enabled. If you choose Microsoft managed, Microsoft chooses the target method and the snooze settings; continue with step 6.
3. Only with Enabled: under Authentication method, choose Passkey.
4. Only with Enabled: set Days allowed to snooze: the number of days before a user who skips gets the prompt again.
5. Only with Enabled: use Limited number of snoozes to decide whether users must register after skipping three times (Enabled) or may postpone without limit (Disabled).
6. Choose which users and groups you include and exclude, and click Save.

💡 The snooze duration applies to the whole tenant, not per group. If you do not want users to keep postponing, set Days allowed to snooze to 0 and Limited number of snoozes to Enabled. They then get the prompt at every MFA sign-in and must register after skipping for the third time.

A campaign stays active until you turn it off yourself. You can also set it up through the Authentication methods policy in Microsoft Graph, with fido2 as the target method.

User experience

After the MFA sign-in, the user is asked to set up a passkey if there is no suitable passkey for their current platform yet. They click Next, after which the device or browser shows where the passkey will be stored. They confirm with face, fingerprint or PIN, give the passkey a name on the Let’s name your passkey screen and finish with Done on the Passkey created screen.

With Skip for now the user postpones the prompt. If something goes wrong during registration, an error screen with Skip appears. That does not count toward the maximum number of snoozes.

Points for your help desk:

• For profiles without restrictions, or with only synced or only device-bound passkeys, the campaign looks at each combination of operating system and browser: a user with a profile without restrictions and only Windows Hello for Business no longer gets a prompt on Windows, but does on macOS.
• Linux users do not get a prompt from a passkey campaign.
• Guest users do not get a prompt, because passkeys are not supported for guests.
• On mobile devices the campaign works in the browser and in native iOS apps. Native Android apps are not supported yet.
• No prompt appears with terms of use during sign-in, with a redirect by Conditional Access custom controls, or if a Conditional Access policy blocks the Register security information page.

Wrapping up

With a registration campaign for passkeys, Entra ID asks eligible users for a passkey after their MFA sign-in. Check the state of your campaign beforehand, because with Microsoft managed the target method can move to passkeys without any action on your part.

📚 All details per passkey profile and platform are in Run a registration campaign to set up a passkey or Microsoft Authenticator.