Daily.Entra.NewsDaily AI-generated highlights from Microsoft Learn and Message Center. Browse the archive from 15 April 2025 → About this project →
The 12 October Entra ID updates focused on authentication guidance. The most consequential clarifications define how registration-campaign profiles are evaluated across platforms, where attested Authenticator passkeys can be registered, and when campaign nudges appear; examples also distinguish Windows Hello for Business from passkey profile restrictions.
Entra ID · AuthenticationThe guidance says unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation. AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.
Entra ID · AuthenticationiOS users can register attested passkeys only directly in the Authenticator app, while Android users can register them directly or through cross-device registration.
Entra ID · AuthenticationEligible users can see nudges during interactive sign-ins that satisfy MFA. Silent SSO events, including refresh token redemption, do not display registration-campaign nudges.
Entra ID · AuthenticationThe guidance states that Windows Hello for Business registration doesn’t follow passkey profile restrictions, so administrators should evaluate it separately when interpreting nudge suppression.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation explains how unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation, while AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.
The documentation now refers to registered passkeys and available passkey types instead of credentials in the platform-specific nudge suppression guidance and table.
The documentation now states that iOS cross-device registration does not support attestation, while Android does. Attested passkeys can also be registered through Android cross-device flows.
The documentation now states that iOS users can register attested passkeys only directly in the Authenticator app, while Android users can register them directly or through cross-device registration.
The documentation now states that Android users can register attested passkeys directly in the Authenticator app or through a cross-device registration flow. iOS registration remains direct through the Authenticator app.
The documentation now separately states that Android users can register attested passkeys through a cross-device registration flow, while iOS users register them directly in the Authenticator app.
The example now specifies a device-bound profile with attestation enforced and an eligible attested passkey. It states that the nudge is suppressed across operating systems and browsers, without using the platform table.
The example now explicitly states that User 1 signs in on macOS with Chrome and is nudged to register a compatible passkey.
The example now specifies that the user’s only registered passkey is Windows Hello for Business; the nudge is suppressed when they sign in on Windows with Chrome.
The documentation now states that Windows Hello for Business registration doesn’t follow passkey profile restrictions.
The documentation now states that Windows Hello for Business registration behavior is separate from passkey profile restrictions.
The MFA registration campaign documentation now links directly to the passkey profile eligibility guidance for the Microsoft managed registration campaign.
The documentation now states that eligible users can see nudges during interactive sign-ins that satisfy MFA. Silent SSO events, such as refresh token redemption, do not display nudges.
