Daily.Entra.NewsThis week’s 13 Entra ID updates refine authentication guidance around passkey registration campaigns and Authenticator passkey enrollment. The most consequential clarifications cover profile-specific nudge suppression, Windows Hello for Business, platform-specific attestation paths, and the sign-in events that display prompts.
Entra ID · AuthenticationThe guidance explains that unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation. AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.
Entra ID · AuthenticationiOS users can register attested passkeys only directly in the Authenticator app. Android users can register them directly or through a cross-device registration flow.
Entra ID · AuthenticationThe campaign guidance states that Windows Hello for Business registration does not follow passkey profile restrictions, so administrators should assess it separately when interpreting nudge suppression.
Entra ID · AuthenticationEligible users can see campaign nudges during interactive sign-ins that satisfy MFA. Silent SSO events, including refresh token redemption, do not display the prompts.
Use the revised profile and platform guidance when troubleshooting why users do or do not receive passkey registration nudges. Support teams should distinguish Windows Hello for Business behavior from passkey profile restrictions and explain that campaign prompts appear during eligible interactive MFA sign-ins, not silent SSO events. The supplied updates support interpretation and user guidance rather than a stated policy-setting change.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation explains how unrestricted, synced-only, and device-bound-only profiles use platform-specific evaluation, while AAGUID-restricted and attestation-enforced profiles suppress nudges across platforms after one eligible passkey is registered.
The documentation now refers to registered passkeys and available passkey types instead of credentials in the platform-specific nudge suppression guidance and table.
The documentation now states that iOS cross-device registration does not support attestation, while Android does. Attested passkeys can also be registered through Android cross-device flows.
The documentation now states that iOS users can register attested passkeys only directly in the Authenticator app, while Android users can register them directly or through cross-device registration.
The documentation now states that Android users can register attested passkeys directly in the Authenticator app or through a cross-device registration flow. iOS registration remains direct through the Authenticator app.
The documentation now separately states that Android users can register attested passkeys through a cross-device registration flow, while iOS users register them directly in the Authenticator app.
The example now specifies a device-bound profile with attestation enforced and an eligible attested passkey. It states that the nudge is suppressed across operating systems and browsers, without using the platform table.
The example now explicitly states that User 1 signs in on macOS with Chrome and is nudged to register a compatible passkey.
The example now specifies that the user’s only registered passkey is Windows Hello for Business; the nudge is suppressed when they sign in on Windows with Chrome.
The documentation now states that Windows Hello for Business registration doesn’t follow passkey profile restrictions.
The documentation now states that Windows Hello for Business registration behavior is separate from passkey profile restrictions.
The MFA registration campaign documentation now links directly to the passkey profile eligibility guidance for the Microsoft managed registration campaign.
The documentation now states that eligible users can see nudges during interactive sign-ins that satisfy MFA. Silent SSO events, such as refresh token redemption, do not display nudges.
