What’s the Least Painful Way to Set Up Passkeys on iPhones?

The passkey provider is partly selected by the operating system, so there may not be a perfect way to force Authenticator without changing the iPhone’s settings. Your main options appear to be allowing synced passkeys, which would let iCloud Keychain handle them, or having users create the passkey through Microsoft Authenticator, typically by opening the app and scanning the displayed QR code. Disabling an attestation requirement may be necessary if synced iCloud passkeys are acceptable for your security model.

Be careful with Conditional Access policies that block the ‘register security information’ action on unmanaged devices. That can also prevent users from registering passkeys or passwordless authentication on personal iPhones, which creates a problem if not everyone has a corporate phone. You may need to separate passkey enrollment rules from broader security-information registration.

There’s also a usability tradeoff here: making Authenticator an autofill provider can interfere with the normal password-filling experience, while allowing iCloud Keychain is much easier for users but may not meet your organization’s requirements. Some organizations avoid this friction by using another authenticator with a more seamless iOS enrollment flow, though licensing and pricing should be considered.

Passkeys aren’t completely offline in the same way that a previously generated one-time code might be. Depending on the flow, the phone and the other device may need internet access, and an off-device passkey flow can also require Bluetooth proximity. That dependency is worth documenting before rolling this out.

For Microsoft Authenticator, users generally need to start the passkey setup from inside the Authenticator app rather than relying entirely on the browser prompt. The QR-code flow is the commonly supported approach, although it’s not especially friendly for a large deployment.