Entra ID adds passkeys for guest users, on by default

Entra ID adds passkeys for guest users, on by default

8 October 2026: Microsoft Entra ID will let B2B guest and external users register passkeys in your tenant and use them to satisfy your multifactor authentication rules. The feature is on by default, and anyone you have left enabled for SMS or voice will be switched on for passkeys whether or not you excluded them from the passkey policy.

Not yet independently verified. Single source: the merill.net archive of the Microsoft 365 Message Center post. We have not read the original in the admin center, and Microsoft can move the dates again. We will update this when it can be confirmed, and remove this note.

Microsoft's Message Center post MC1459133 puts the start of the rollout for internal guest users in late October 2026, with completion in late November. Both dates have slipped by about a month from the earlier plan (early October and late October). External users, meaning people with no account in your directory, get no date yet; Microsoft says timing will follow in a later update. Internal guests can also use Microsoft Authenticator app passkeys, which external users cannot.

Until now a guest could not use a passkey from the resource tenant when that tenant demanded MFA and did not trust the home tenant's MFA. Members already had passkeys in their home tenant. The change closes that gap, so guests can register from the resource tenant's My Security Info page, from a proof-up prompt or from a passkey registration campaign.

Microsoft says no action is required, but one detail deserves attention. Under the SMS and voice retirement described in MC1426371 and MC1434201, any user enabled for either method in the Authentication methods policy or in the legacy MFA policies is automatically enabled for all passkey types. Guests are included once B2B support arrives. Excluding a group from the passkey policy alone therefore does not keep it out while it remains enabled for SMS or voice.

Microsoft's own checklist for administrators:

• Confirm which guests and external users are in scope for passkeys in the Authentication methods policy.
• Move any B2B users you do not want enrolled off SMS and voice in every applicable policy, legacy MFA policies included.
• Check that the registration campaign targets the intended users.
• Test that Conditional Access and authentication strength requirements still apply to guests as you intend.
• Warn the help desk that guests may start seeing registration prompts.

Passkey registration data is stored as part of Entra authentication management, and Microsoft says no other customer data handling changes. Our identity management software category lists seven products and our authentication software category lists six, for teams weighing what sits alongside Entra for partner access.

Sources

• Microsoft 365 Message Center archive (merill.net): MC1459133 Microsoft Entra ID: Passkey support for B2B users, 8 October 2026