Security

Microsoft Entra Passkeys: 2026 Passwordless Updates

3 min read

Summary

Microsoft outlined major passkey and account recovery updates across Entra ID, Windows, External ID, and Microsoft Password Manager as part of World Passkey Day. The changes matter for IT teams because they expand phishing-resistant sign-in options, improve recovery security, and continue the retirement of weaker authentication methods such as security questions.

Need help with Security?Talk to an Expert

Introduction

Microsoft is using World Passkey Day to highlight a broader push toward phishing-resistant, passwordless authentication. For IT administrators, this is more than a product announcement: it signals continued investment in passkeys, stronger recovery controls, and the phased removal of weaker sign-in methods across Microsoft Entra.

What’s new

Passkey expansion across Microsoft Entra

Microsoft announced several updates designed to make passkeys easier to deploy and use across enterprise and customer-facing scenarios:

  • Synced passkeys and passkey profiles in Microsoft Entra ID help organizations scale passwordless sign-in across different environments.
  • Microsoft is transitioning tenants to a unified passkey profile model and expanding support for more complex cloud passkey management policies.
  • Passkey-preferred authentication in Microsoft Entra ID is now in preview, automatically prompting users with the strongest registered method first.
  • Passkeys for Microsoft Entra External ID will reach general availability in late May 2026, bringing passkey support to customer-facing applications.
  • Entra passkeys on Windows will also be generally available in late May 2026, allowing users on personal or unmanaged Windows devices to create and use device-bound passkeys with Windows Hello.

Consumer and cross-device improvements

Microsoft also said users can now save and sync passkeys with Microsoft Password Manager, with iOS and Android support coming soon in Microsoft Edge.

Stronger account recovery

A key theme in the announcement is that passwordless security also depends on secure fallback paths. Microsoft Entra ID account recovery is now generally available, enabling users who lose all authentication methods to recover access through identity verification using:

  • Government-issued ID
  • Biometric face checks

Microsoft is also expanding its verification partner ecosystem with 1Kosmos and CLEAR, alongside existing partners Au10tix, IDEMIA, and TrueCredential.

Weak methods are being removed

Microsoft confirmed that security questions will be removed as a password reset option in Microsoft Entra ID starting January 2027 due to their susceptibility to guessing and social engineering.

Why this matters for IT admins

These updates help reduce exposure to phishing and credential theft while improving the user sign-in experience. Microsoft also tied the urgency to AI-powered attacks and agent-based workflows, where a compromised identity could give attackers broader operational access.

For organizations standardizing on Entra ID, the message is clear: stronger authentication now includes both passkey adoption and hardening recovery flows.

Next steps

  • Review your current Microsoft Entra passwordless strategy.
  • Test passkey-preferred authentication in preview.
  • Plan for Entra passkeys on Windows and External ID GA in late May 2026.
  • Audit password reset methods and prepare for the removal of security questions in January 2027.
  • Evaluate whether your recovery processes align with Microsoft’s stronger identity verification model.

Microsoft’s latest updates show that passkeys are moving from optional enhancement to a core identity security control.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Vasu Jakkal and Nadim Abdo
Microsoft Entrapasskeyspasswordless authenticationphishing-resistant MFAaccount recovery

Related Posts

Security

Fake Download Campaign Delivers Trojanized Installers

Microsoft Threat Intelligence detailed a fake-download campaign that uses trojanized Inno Setup-style installers to silently deliver multiple monetization payloads in a single session. The activity matters to IT and security teams because it can turn devices into proxy, compute, or adware assets without informed user consent, increasing privacy, performance, and security risk.

Security

Microsoft Agent 365 Named Leader in Gartner 2026

Microsoft has been named a Leader in Gartner’s inaugural 2026 Magic Quadrant for AI Agent Management Platforms, highlighting momentum behind Microsoft Agent 365. For IT and security teams, the news underscores Microsoft’s push to bring identity, governance, discovery, and risk-based controls to enterprise AI agents across Microsoft and third-party ecosystems.

Security

Exploited Vulnerabilities: Key Patterns Defenders Must Know

Microsoft Security’s latest analysis shows that only about 0.5% of disclosed CVEs are exploited in the wild, but attackers consistently favor high-impact flaws such as remote code execution, privilege escalation, and authentication bypass. The findings matter for defenders because patching critical systems often takes weeks or longer, while weaponization can happen within days of disclosure.

Security

Claude Code Extension Attack: SSH Backdoor Findings

Microsoft Threat Intelligence analyzed a malicious Claude Code-branded extension briefly distributed through the Cursor marketplace that attempted to install an SSH backdoor, create reverse tunnels, and establish persistence. The incident appears limited to Cursor marketplace, but organizations should identify affected systems, preserve evidence, remove artifacts, and review endpoint and network telemetry for signs of compromise.

Security

AD CS ESC1 and ESC8 Attacks: Microsoft Findings

Microsoft Threat Intelligence detailed two intrusions where attackers used Microsoft Teams help desk impersonation and Quick Assist sessions to gain remote access, then abused Active Directory Certificate Services through ESC1 and ESC8 paths. The research highlights how misconfigured AD CS environments can turn a socially engineered session into durable privileged access, making certificate hardening and containment coverage critical for defenders.

Security

North Korean Threat Actors Expand AI Attack Tradecraft

Microsoft Threat Intelligence says North Korean threat actors are rapidly expanding AI use across reconnaissance, social engineering, tooling development, and operational scaling. The report matters for security teams because AI is accelerating familiar attack chains rather than replacing them, increasing the speed and volume of targeted campaigns against financial, technology, government, and education organizations.