Skip to Content

MC1459133 Microsoft Entra ID Passkey support for B2B users

Summary

  • Microsoft Entra ID will support passkey registration and sign-in for B2B users, including internal guest users and external users, using resource-tenant-issued passkeys.
  • Eligible B2B users who are in scope for passkeys in Authentication methods policy will be able to satisfy the resource tenant’s MFA requirements with passkeys.
  • Microsoft Authenticator app passkeys are supported for internal guest users, but not for external users.
  • The feature is enabled by default, and users may be prompted to register a passkey through My Security Info, proof-up flows, or registration campaigns.
  • Administrators should review Authentication methods policy, passkey registration campaigns, and Conditional Access scoping to ensure guest and external user behavior is intentional.

Microsoft Entra ID will support passkey registration and sign-in for B2B users, enabling phishing-resistant MFA using resource tenant passkeys. Rollout begins October 2026, with automatic enablement for eligible users. Administrators should review authentication policies and configurations; no immediate action is required.

Microsoft 365 Message Center ID: MC1459133
Primary Service: Entra
Admin Impact: Medium
User Impact: Medium
Release Start: 01 Oct 2026
Release End: 28 Feb 2027
Last Modified: 15 Sept 2026
Category: Stay informed
Tags: New feature, Feature update, User impact
Status: Launched
Products & Platforms: Microsoft Entra

History

Updated September 14, 2026: We have updated the content. Thank you for your patience.
8/21/2026 Item Added to Message Center

Microsoft Message

Microsoft Entra ID will support passkey registration and sign-in for B2B users, including internal guest users and external users. Eligible B2B users will be able to register and use passkeys issued by the resource tenant to satisfy that tenant’s multifactor authentication (MFA) requirements.

Passkeys are already supported for member users in their home tenant. Until now, B2B users could not use a resource tenant passkey when that tenant required MFA and did not trust the home tenant’s MFA. This update closes that gap and gives guest and external users a phishing-resistant way to satisfy MFA requirements in the resource tenant.

B2B users can register a resource tenant passkey from the resource tenant’s My Security Info page, during a proof-up prompt, or through a passkey registration campaign. Once registered, the passkey can satisfy the resource tenant’s MFA requirements during sign-in.

Microsoft Authenticator app passkeys will be supported for internal guest users but not for external users.

Important: This rollout intersects with the previously announced retirement of SMS and voice authentication. As described in Message Center posts MC1426371 and MC1434201, any user enabled for SMS or voice in the Authentication methods policy or legacy MFA policies will be automatically enabled for all passkey types. This will include eligible B2B users when B2B passkey support becomes available.

Rollout schedule

General Availability (GCC, Worldwide): Beginning in early October 2026 and expected to complete by late February 2027

  • Internal guest users: Beginning in early October 2026 and is expected to complete by late October 2026
  • External users (excluding Microsoft Authenticator app passkeys): Rollout timing will be communicated in a future Message center post update.

Impact on your organization

Who is affected

  • Microsoft Entra administrators managing Authentication methods policies
  • Organizations that use Microsoft Entra B2B collaboration
  • Internal guest users and external users who are in scope for passkey authentication
  • Internal guest users and external users who are enabled for SMS or voice in the Authentication methods policy or legacy MFA policies

Platforms and services

  • Microsoft Entra ID
  • My Security Info
  • Authentication methods policy
  • Conditional Access

What will happen

  • The feature will be enabled by default.
  • B2B users who are already in scope for passkeys in your Authentication methods policy will automatically be able to register and sign in with resource tenant passkeys.
  • Eligible B2B users may receive prompts to register a passkey during sign-in through proof-up experiences or passkey registration campaigns, if those experiences are configured in your tenant.
  • Users can also register a passkey from the resource tenant’s My Security Info page.
  • If your organization has excluded B2B users from passkeys in the Authentication methods policy, and those users are not separately subject to automatic passkey enablement through the SMS and voice retirement changes, they will not be prompted and will not be able to register or sign in with a resource tenant passkey.
  • Under the SMS and voice retirement changes described in MC1426371 and MC1434201, B2B users who are enabled for SMS or voice in the Authentication methods policy or legacy MFA policies will be automatically enabled for all passkey types. Excluding these users from the passkey policy alone will not prevent this automatic enablement if they remain enabled for SMS or voice.
  • This change gives guest and external users a phishing-resistant sign-in option and helps organizations extend strong authentication requirements to their B2B population.

Action required and recommendations

No action is required.

We recommend that administrators review current passkey and MFA configurations before rollout:

  • Review your Authentication methods policy. Confirm which users are in scope for passkeys, including guest and external users. B2B users who are in scope will be enabled automatically. Exclude them from the policy if that is not the intended behavior.
  • Review Message Center posts MC1426371 and MC1434201 for details about the SMS and voice retirement changes.
  • Review SMS and voice assignments in both the Authentication methods policy and legacy MFA policies. If you do not want specific B2B users to be automatically enabled for all passkey types, move those users off SMS and voice in all applicable policies. Excluding them only from the passkey policy is not sufficient while they remain enabled for SMS or voice.
  • Review your passkey registration campaign. Confirm that the campaign’s user scope includes the intended users.
  • Review your Conditional Access policies. Confirm that MFA and authentication strength requirements will apply as intended for B2B users when resource tenant passkeys become available.
  • Confirm user scoping across authentication-related policies. Make sure the groups and user types targeted by each policy align with your organization’s requirements for guest and external users.

Consider notifying your help desk and identity support teams that eligible B2B users may begin receiving passkey registration prompts after rollout.

Compliance considerations

Question: Does the change store new customer data?

Answer: Passkey credential registration data may be stored as part of Microsoft Entra authentication management.

Question: Does the change alter how existing customer data is processed, stored, or accessed?

Answer: The change introduces an additional authentication method for B2B users accessing resource tenant resources.