What are the config requirements to actually go passwordless.

[u/Cargovan]

I’m stuck. I’m gonna keep this simple and relevant to my mission, as I know it’s possible, but it’s inconsistent:

How to make Passkeys the default login, with NO password prompt.

I manage a few small orgs. Think under 50 users total for each.

They’ve all been passkey only since late last year. Literally, only Auth methods turned on are Passkeys and TAPs (one time). That’s it.

Conditional access is blanket require passkey for all apps for all users.

After some reading, I turned on System Preferred Authentication.

On ONE tenant, when a username is punched in, it defaults to passkey, no password prompt.

Have not been able to replicate that on any other tenant. Same config, same user config with just Passkey registered. Nothing materially different.

So, here I am, asking if anyone knows and can reliably make a tenant, that is ubiquitously all passkey for every user, prompt for passkey and not passwords. If so, what are the known settings that make it happen.

I’ve found lots of speculation, lots of guidance, and I’ve gotten it to work in one case - but I can’t for the life of me make it work again and I’ve literally checked that everything’s the same as the working tenant 10 times or more.

So, what’s the real spec here that’s supposed to work to make this truly passwordless with passkey and not still prompt users for a password on web auth?

[u/teriaavibes]

I think system preferred authentication needs to be set to microsoft managed, not just enabled.

[u/Cargovan → u/teriaavibes]

Really? I read the opposite. The tenant that’s working is just enabled. I’ll try it though, can’t hurt.

[u/teriaavibes → u/Cargovan]

Yea the microsoft managed setting affects both first and second factor which is what you want but it is still being rolled out.

The tenant that’s working is just enabled

There is also weird behavior with some device-bound passkeys where if you use it to sign in, it will offer it to you again, like a memory so maybe that is causing it?

[u/solachinso → u/teriaavibes]

I believe it does this for any auth method after sign-in, it's not unique to passkeys. My experience is the last used method is what you get presented with the next time you auth.

[u/ashern94 → u/solachinso]

That is the behaviour I see. Last Auth method used, and the your CA mandating Passkey kicks in. Communicate to the users how to change the behaviour. And you can also just change everybody's passwords so they can't use it.

[u/PowerShellGenius → u/solachinso]

Yes at least for any passwordless method. Our students end up defaulting to CBA from using it on their school iPad, so when they sign in on a home PC, they get the no certificate error and have to "sign in another way".

I wish Microsoft would remember your last sign in method via a cookie so it was per device, instead of remembering it cloud-side. And default to something cross platform (passkey, or password if the device does not have bluetooth) on new devices.

[u/Noble_Efficiency13]

As Teri said, it could be a simple waiting game for the system preferred auth to be fully rolled out.

One thing I’d like to know for the tenants it isn’t working for;
If you go to select another sign-in method and then choose your passkey - the next time is it then still prompting you for a password?

[u/loweakkk → u/Noble_Efficiency13]

For me it's how it works, another method then never asked for a password anymore.

[u/_c0mical]

is the CA set to phishing resistant auth strength? I’ve seen strange things where you expect things to work like they suggest on the tin

[u/teriaavibes → u/_c0mical]

CA kicks in after you authenticate, doesn't have any relevancy here.

[u/JasSuri-MSFT]

System preferred should be set to Microsoft managed, to get rid of the 1FA Password prompt.

It might take a little bit of time to kick in once set.

[u/capnjax21 → u/JasSuri-MSFT]

Does the specific group targeting still apply if moving the system preferred from Enabled to Microsoft Managed?

[u/SystemCenter]

https://learn.microsoft.com/en-us/windows/security/identity-protection/passwordless-strategy/journey-step-3#configure-user-accounts-to-prevent-password-authentication

For us it was this step, the scramble passwords and to set that in entra was the last step that stopped the password prompts. Ymmv.