Microsoft Entra brings passkeys to B2B guest users

Microsoft announces that B2B guest users will be able to register and use passkeys (FIDO2) in the resource tenant, enhancing MFA options for external collaborators. Currently, resource-tenant FIDO2 registration is unsupported for guests, but this change removes that restriction. Eligible users can register a passkey via My Security Info or proof-up prompts. The feature will be enabled by default from October 2026, with rollout to Worldwide and GCC tenants expected to complete by February 2027. Internal guests will also support passkeys in Microsoft Authenticator, while external users will have limited options. Administrators can manage and remove these credentials, and passkey profiles will govern registration policies.