I'm testing passkeys in Microsoft Entra ID. I created a passkey authentication policy for a test user with attestation enforcement disabled and the passkey type set to "Synced." I then registered a passkey in Microsoft Authenticator.
However, Authenticator only offers backup through a personal Microsoft account, not a work or school account. After restoring Authenticator on a second test phone from that backup, the passkey itself was missing. Microsoft's documentation appears to explain that passkeys stored in Authenticator are device-bound and aren't currently synchronized, even when the Entra policy allows synced passkeys.
Is this expected behavior? If so, what is the purpose of selecting "Synced" passkeys when Microsoft Authenticator doesn't sync them? Is Microsoft planning to support passkey backup to work or school accounts? At the moment, I had to require MFA re-registration for the test user before registering a new passkey.
4 Answers
A synced passkey has to be stored by a provider such as a password manager, a platform account, or a device ecosystem that supports passkey synchronization. That also means the security of the account doing the syncing becomes part of the organization’s security boundary. Many administrators therefore prefer device-bound passkeys, especially for privileged accounts, even though replacement and recovery are less convenient.
For a replacement phone, the normal process is to add and register a new authentication method, then remove the old one. If the user can’t sign in because the old phone is unavailable, issue a Temporary Access Pass and use it to register the new Authenticator or passkey. Requiring MFA re-registration is another recovery option, but it usually shouldn’t be the only documented procedure.
Yes, that is currently expected. Authenticator passkeys are device-bound, so restoring the app’s backup does not restore the passkey credential. The “Synced” setting describes the credential type Entra ID accepts; it does not mean Microsoft Authenticator will synchronize that credential between phones.
Authenticator backup is not a passkey migration mechanism. It can restore supported app data and registrations, but the private key for a device-bound passkey remains tied to the original device. Make sure every account has a recovery method or a second registered device before wiping or replacing a phone; otherwise account recovery can become a lengthy support process.
That trade-off is exactly why synced and device-bound passkeys are separate choices. Synced credentials are easier to recover, but they need additional controls such as compliant devices or another MFA method.