For the past couple years I kept asking the same question: how does Microsoft plan to move everyone to passwordless when a brand new user cannot register a passkey in the first place? Because that is the catch. Registering a passkey requires MFA, and a brand new user has nothing to complete MFA with. Temporary Access Pass was the way around it. It works, but issuing one per person is exactly the friction that sends organizations back to a phone number. That is still how it works today. From mid-October 2026 it changes. Previously, the wizard offers a phone number. That becomes method one, and it stays as the fallback nobody removes.

From Mid October-2026, Message Center post MC1450133 confirms a user with no MFA method can register a synced passkey, a Microsoft Entra passkey on Windows, or a FIDO2 security key as their first method. Phase 2 adds Windows Hello for Business, macOS Platform SSO and Microsoft Authenticator between early January and late February 2027.

Nothing weaker has to exist first, so nothing weaker is left behind to phish later.

On by default. Worldwide and GCC. Anyone who already has a method is untouched.

Microsoft says no action is required. Three things still decide whether it helps you:

Conditional Access. If your "Register security information" policy requires MFA, a user with no method still cannot pass it. They need a Temporary Access Pass.

Authentication methods policy. Passkey (FIDO2) enabled, self-service set up on, and a passkey profile that includes the devices your people actually carry.

Onboarding. Point new starters at the passkey, not the phone number. The old fallback only exists if you tell someone to create it.

One caveat worth pointing out to peopl is that this helps new starters. It does nothing for the people already signing in with a texted code, and Microsoft provided SMS and voice retire on 1 February 2027. That population needs finding ASAP.

Source: MC1450133, published 7 August 2026.

#MicrosoftEntra #Passkeys #IdentitySecurity #Microsoft365 #ZeroTrust