Entra ID: guests can now use passkeys issued by your tenant

What changed

B2B users — internal guests and external users — will be able to register a passkey issued by the resource tenant (your tenant) and use it to meet your tenant’s multifactor authentication requirements. Until now, passkeys only worked for member users in their home tenant.

Guests can register the passkey from your tenant’s My Security Info page, in-line during an MFA proof-up prompt, or through a passkey registration campaign.

Who is affected

Tenants that invite B2B guests and have passkeys enabled in the Authentication methods policy. Per the Roadmap item, the change is on by default: B2B users already in scope for passkeys in your Authentication methods policy are enabled automatically.

What you should do

In the Microsoft Entra admin center, open Authentication methods → Policies → Passkey (FIDO2) and check the target groups. If the policy targets All users, guests are in scope.
Decide whether guests should register passkeys in your tenant. If not, scope the passkey policy to a members-only group before rollout.
Review Conditional Access policies that use authentication strengths for guests — a passkey can now satisfy them.
If you run a registration campaign, check whether its scope now nudges guests to register.
Tell your helpdesk: guests may start asking how to register or remove a passkey in your tenant.

Deadline / rollout

General availability: October CY2026, as listed on the Microsoft 365 Roadmap (ID 569432). No action is required to turn it on.

Risk if ignored

Medium. Nothing breaks, but guest authentication behaviour changes in your tenant without a decision from you. Review the scope so it matches your guest-access policy.

Weekly · 5-minute read

The Identity Brief

Identity & Microsoft 365 changes that need action, one SOP, one script — every week. Verified against official Microsoft sources.

No spam. Unsubscribe anytime. Privacy