Microsoft 365 Passkeys Not Working? 6 Common Problems and How to Fix Them

Microsoft 365 passkeys offer stronger, phishing-resistant authentication, but that doesn't mean every registration goes smoothly.

Users can't register passkeys, Conditional Access policies create authentication loops, QR codes fail, and users replace their phones only to discover their passkeys are missing.

After working through numerous passkey deployments, I've encountered several issues that come up repeatedly.

In this guide, I'll walk through six common Microsoft 365 passkey problems, how to troubleshoot them, and the steps you can take to resolve them.

Before You Start: Standardize What You Support#

My first recommendation is to limit the number of passkey types your organization supports.

Windows Hello for Business, Microsoft Authenticator, synced passkeys, and FIDO2 security keys all have different registration requirements, device dependencies, and recovery processes.

For most organizations, my preferred baseline is Windows Hello for Business on Windows, Platform SSO on managed Macs, and device-bound Microsoft Authenticator passkeys on mobile.

The fewer variations you support, the easier your helpdesk procedures become.

1. Passkey Registration Option Is Missing#

Symptom: A user opens their Security Info page, but doesn't see an option to add a passkey.

This typically indicates the user isn't assigned to an enabled passkey profile.

How to troubleshoot:

1. Open Entra ID → Authentication methods → Policies → Passkey (FIDO2).
2. Verify the policy is enabled and self-service setup is allowed.
3. Review the groups assigned to your passkey profiles.
4. Confirm the affected user is a member of one of those groups and isn't excluded.

One common scenario is targeting users through a registration campaign without also assigning them an enabled passkey profile.

Fix: Correct the group assignment and have the user retry registration at https://mysignins.microsoft.com/security-info (opens in new tab).

2. "Passkey Not Registered" Error#

Symptom: A user attempts to register a passkey but receives the generic "Passkey Not Registered" error.

This is one of the most common issues I've encountered.

For example, a user might attempt to save a synced passkey in LastPass when their assigned profile only supports device-bound credentials.

The browser or password manager can offer to create the passkey, but Microsoft Entra rejects the registration because it doesn't match the assigned policy.

How to troubleshoot:

• Verify the user's assigned passkey profile.
• Check whether the profile supports device-bound, synced, or both types.
• Review AAGUID restrictions and attestation requirements.
• Identify which passkey provider the user selected.
• Check whether the user is using a private browsing window or an expired registration session.

Fix: Direct the user to register a credential supported by their assigned profile.

If you're standardizing on Microsoft Authenticator, I recommend having users register directly through the Authenticator app to minimize provider-selection problems.

3. Microsoft Authenticator Says "We Ran Into an Error"#

Symptom: A user attempts to register a passkey in Microsoft Authenticator but receives a generic error stating the account couldn't be added.

One of the biggest causes is a Conditional Access registration loop.

This commonly occurs with two types of policies:

• Require phishing-resistant MFA: The policy applies to all resources, but the user hasn't registered a phishing-resistant method yet.
• Require app protection policy: An all-resources policy blocks registration because Microsoft Authenticator can't satisfy the specified app protection requirement for that flow.

Effectively, we're asking the user to meet an authentication requirement they can't currently fulfill.

How to troubleshoot#

1. Open Entra ID → Monitoring & health → Sign-in logs.
2. Find the affected user's sign-in around the time registration failed.
3. Open the event and review the Conditional Access tab.
4. Identify which policy failed and review its targeted resources and grant controls.

Fix: Exclude Microsoft Authenticator Credential Registration#

Microsoft has introduced a dedicated resource called Microsoft Authenticator Credential Registration that can be excluded from applicable Conditional Access policies.

This is a more targeted alternative to temporarily excluding the user from an entire policy.

To use this feature, you may first need to provision the Microsoft-managed enterprise application in your tenant.

Step 1: Open PowerShell 7 as Administrator

Step 2: Install and import the Microsoft Graph Applications module

Install-Module Microsoft.Graph.Applications -Scope CurrentUser
Import-Module Microsoft.Graph.Applications

If the module is already installed, you only need to import it.

Step 3: Connect to Microsoft Graph

Replace <TenantID> with your Microsoft Entra tenant ID.

Connect-MgGraph -Scopes "Application.ReadWrite.All" -TenantId "<TenantID>"

Sign in using an appropriately authorized account, such as Cloud Application Administrator or Application Administrator.

Step 4: Create the enterprise application's service principal

New-MgServicePrincipal -AppId "6aa00308-ea33-4caa-90d6-ae905d8cb51b"

This provisions the Microsoft Authenticator Credential Registration enterprise application. If it already exists, you don't need to recreate it.

Step 5: Exclude the resource from Conditional Access

1. Navigate to Entra ID → Protection → Conditional Access → Policies.
2. Open the policy creating the registration loop.
3. Under Target resources, locate the resource exclusions.
4. Select Microsoft Authenticator Credential Registration.
5. Save the policy and test registration again.

Important: This resource exclusion addresses registration through the Microsoft Authenticator application. It does not automatically resolve other authentication requirements, including policies targeting Register security information.

For users accessing their Security Info page, you may still need a controlled bootstrap process, such as a temporary Conditional Access exclusion or a policy that permits Temporary Access Pass.

Microsoft has documented the new resource for availability beginning in November 2026, so confirm it is available in your tenant.

Microsoft reference: Enable and support passkeys in Microsoft Authenticator (opens in new tab)

4. QR Code or Cross-Device Passkey Registration Fails#

Symptom: A user tries to register or use a passkey on their phone by scanning a QR code from their computer, but the process fails.

There are two common causes worth investigating.

Bluetooth or connectivity problems#

Cross-device passkey authentication requires both devices to have Bluetooth enabled and an active internet connection.

If either device has Bluetooth disabled, the cross-device handshake can fail.

Fix: Check Bluetooth and internet connectivity on both devices. If connectivity is still failing, review network restrictions affecting cross-device passkey authentication.

Attestation requirements#

Another scenario occurs when your passkey profile enforces attestation.

For Microsoft Authenticator, attestation can restrict which registration flows are supported. Direct registration inside the Authenticator app is the most reliable approach, particularly on iOS. Android support can differ by registration flow and platform version.

Fix: Review the assigned profile's attestation settings and have the user attempt registration directly inside Microsoft Authenticator.

5. Hardware or Software Doesn't Meet Requirements#

Symptom: Registration fails despite the user having the correct Entra configuration.

Passkeys have hardware and software requirements that aren't supported by every device.

What to check:

• Supported iOS or Android version
• Current Microsoft Authenticator version
• Secure hardware availability
• Android work profile configuration
• Browser and operating system compatibility

For Microsoft Authenticator passkeys, users generally need iOS 17+ or Android 14+, along with compatible security hardware.

Fix: Update the device or application when possible. If the hardware isn't compatible, provide an approved alternative credential.

Windows Hello for Business tip: Users frequently confuse their Windows Hello PIN with their Microsoft 365 password. Have a documented PIN reset process and explain that the PIN is tied to the device.

6. A User Loses or Replaces Their Phone#

Symptom: A user gets a new phone, restores Microsoft Authenticator, and discovers their passkey is missing.

Microsoft Authenticator passkeys are device-bound and can't be restored from an Authenticator backup.

Synced passkeys are different because they may be recovered through the user's credential provider.

Recommended recovery SOP#

1. Verify the user's identity using your approved helpdesk process.
2. Check existing authentication methods to determine whether they have a usable backup.
3. Issue a Temporary Access Pass (TAP) if needed.
4. Have the user register a new passkey on the replacement device.
5. Verify successful authentication and remove the obsolete credential from Entra.

Conditional Access considerations#

A common obstacle is a Conditional Access policy requiring MFA for the Register security information user action.

If the user has lost their only usable method, they may be unable to satisfy that requirement to register a replacement.

TAP can help bootstrap recovery because it satisfies standard MFA requirements, provided the user and policy configuration allow it.

However, TAP does not automatically satisfy a phishing-resistant authentication strength.

If you enforce phishing-resistant MFA across resources, make sure you've configured a controlled recovery path that allows the user to register a replacement credential without unnecessarily weakening normal sign-in requirements.

Microsoft reference: Configure Temporary Access Pass (opens in new tab)

Final Thoughts#

When troubleshooting Microsoft 365 passkeys, I recommend starting with three questions:

What? Which passkey or credential type is the user trying to register or use?

Where? Which device, browser, or application is involved?

When? Is the failure happening before registration, during registration, or when signing in?

Those three questions help narrow down where to investigate.

Ultimately, my recommendation is to standardize what you support and build repeatable procedures for registration failures, Conditional Access issues, and recovery.

I've also put together a more comprehensive Passkey Helpdesk Blueprint and end-user registration guides that you can access through my free community (opens in new tab).

For live demonstrations of these issues and their resolutions inside Microsoft Entra, check out my accompanying YouTube video.