How are you handling passkey setup for new hires?

A Temporary Access Pass can bridge the gap between a new account and the employee registering a passkey. One approach is to issue a one-time pass, let the employee register Microsoft Authenticator, then use that credential to enroll their computer and set up Windows Hello for Business.

Check your Conditional Access and authentication strength settings against the registration flow. If a policy requires phishing-resistant authentication before the user has a way to register it, you can create a bootstrap problem. Test the whole sequence with a fresh account rather than assuming the prompts will appear in the right order.

Give people a choice of authenticator where you can. A phone-based passkey may work for employees willing to use a personal device, while a hardware security key is an option for someone who isn't. Build the handoff and registration of the key into onboarding.

Take a look at the registration campaign settings too. The announced Microsoft-managed campaign targets passkeys for users in eligible tenants. Managing the campaign settings yourself is an option if you want to control the rollout rather than rely on Microsoft-managed settings.

That's separate from figuring out how a new hire gets their first usable credential, so I'd check both the campaign and your Conditional Access rules.

One possible workflow is for an admin to use a Temporary Access Pass to set up a credential before onboarding, with the employee changing the initial PIN or screen lock during onboarding. That puts the initial setup in admin hands, though, so consider the security implications and whether having the employee register their own credential is a better fit.

It's also worth looking beyond the first Microsoft sign-in. A password manager that supports passkeys could give employees a way to manage credentials for other products without relying entirely on a personal phone.