Folks, you might have been caught out by this but it's what Microsoft said they would do, according to the docs. Since Sept 1, tenants with an attestation-enforced or AAGUID-restricted passkey policy are suddenly seeing users register synced and browser passkeys. Admins are asking "why isn't Microsoft respecting my FIDO2 policy?" Here's what's going on. The "Passkeys by default" retirement page on Learn (published July 14) says this in its Important box: "Users enabled for SMS or Voice ... will be auto-enabled for passkeys in AMP. These in scope users will be put into a passkey profile allowing ALL types of passkeys. Your Registration Campaign settings will be set to Microsoft Managed state targeting passkeys." Two important notes: 1. Passkey profiles are a union. If a user is in more than one profile, a passkey only has to satisfy ONE of them. So your attestation-enforced profile is still there. Microsoft just added a second, unrestricted profile next to it for every SMS/voice user, and that one wins for registration. 2. Your registration campaign state doesn't protect you. Disabled, Enabled, doesn't matter. The doc says it gets set to Microsoft Managed regardless, which is why some of you saw your campaign config wiped with Microsoft in the audit log. Even with the campaign off, the new profile lets users self-register a non-attested passkey from My Security Info. The ONLY way to avoid this was the opt-out flag on the authentication methods policy: PATCH graph.microsoft.com/beta/pol… { "optOutSettings": { "passkeyDynamicMigration": true } } Or moving users out of SMS and voice before Sept 1. Where Microsoft dropped the ball: the Message Center post (MC1426371) only says "passkeys will be automatically enabled for users currently enabled for SMS or voice." It never mentions a new unrestricted profile or that your attestation/AAGUID restrictions would be bypassed. And MC1469555 says the campaign "does not override configured passkey policies", which is technically true and practically misleading. The passkey profile part is only on Learn. So: not a bug, but a really important detail buried in one paragraph on a docs page. What to do now: - Look at your passkey profiles for a Microsoft-created one with both passkey types and no restrictions, and check who's targeted. - Set the opt-out flag if you need attestation to hold, then clean up that profile. Note the doc says the flag stops working Feb 1, 2027. - If you already had the flag set and it still changed, that IS a bug. Open a case. Docs: learn.microsoft.com/entra/id…

Passkeys are changing the game—and the timeline for adoption got expedited. Join @paulsems, @TechBrandon, and Jason Crawford on Wed, October 7 for "AMA: Passkeys and Preventing Credential Theft" and get answers to your #passkey questions. Register now! hubs.la/Q04y2N1w0

UPDATE 📣 Organizations used to ask themselves "if" they'd adopt passkeys; #Microsoft decided the "when" for us, as of Sept 1, 2026. Our updated blog by @TechBrandon covers how Entra is implementing passkeys and what every role needs to know. Read it now! hubs.la/Q04xyjR40

I can't believe I'm tweeting about new NTLM features coming to Windows Sever 2019 🙀

And finally, the biggest issue of all - you must use Sign-in Frequency of Every time If you only select Require MFA and the attacker has MFA on their token, it passes the check... Forcing every time ensures the attacker must reauthenticate to get new tokens, locking them out ;)

Active directory is roughly twice the age of Entra (formerly Azure Active Directory). Roughly 26.5 years old to almost 13.5 years old. Active Directory has had about 13 years MORE lifetime for researchers and threat actors to find vulnerabilities. Chances are there will be more serious vulnerabilities discovered in Entra & associated cloud components over the coming years. As there likely will with Active Directory. Don't think because some guy on the internet says AD is defensible or Entra is better means that you can rest on your laurels.

We're not changing the name of Lake Ontario. Name it whatever you want at your leisure: gulfof.mapquest.com/lakeonta… (tag us so we can see your work 🙂)

oh no