I manage Microsoft 365 for a small nonprofit and am updating our documentation so another person could take over if needed. I recently added a YubiKey as a backup sign-in method for the admin account, but after configuring passkeys/security keys, the sign-in process only offers the passkey instead of also showing Microsoft Authenticator.
I understand that passkeys and security keys are phishing-resistant, but I would like users to be able to choose either the security key or the Authenticator app when signing in. I created separate authentication method and Conditional Access configurations, but I am not sure how to define the policy so both methods are available.
After enabling both methods, I can select "Sign in another way" and use Authenticator, but accessing the Microsoft 365 admin center sometimes fails with "Access has been blocked by Conditional Access policies. The access policy does not allow token issuance." The sign-in works with the passkey or security key. I also noticed the issue seemed to occur when connecting through a home VPN, while the same process worked onsite. Conditional Access logs showed error 53003. Eventually, I discovered that multiple private browser windows were contributing to the problem, so I am testing again with a clean browser session.
3 Answers
Also verify licensing before relying on Conditional Access. The users administering these policies need a license that includes Conditional Access, such as an appropriate Microsoft Entra ID or Microsoft 365 premium entitlement; basic-only accounts may not be covered. Keep an emergency access account with carefully controlled backup authentication, and test policy changes before applying them broadly so the administrator does not get locked out.
Error 53003 generally means a Conditional Access policy blocked token issuance because the sign-in did not satisfy one of the policy requirements. Check the sign-in details for the exact policy, authentication strength, location or named-location rules, device requirements, and whether the account is included or excluded as expected. VPN traffic can appear from a different public IP and may be treated differently from an onsite sign-in. Testing with one clean browser session is also important because several private windows can retain conflicting authentication state.
In the authentication methods area, create or use a group that is allowed to use both passkeys/security keys and the Authenticator app. Then configure an authentication strength in Conditional Access that permits both methods. During sign-in, cancel the passkey prompt and choose “Sign in another way” to select Authenticator, assuming that method is registered and allowed by the policy.
That got the alternate methods to appear, but I initially still received a token-issuance error when opening the admin center. I am checking the Conditional Access requirements and sign-in logs now.
The VPN difference made me suspect a location rule, but multiple private windows were also involved. After closing them and starting with a clean session, the behavior looked much more consistent.