Microsoft is making passkeys the default authentication experience, and I'm trying to find a practical setup for iPhone users. Windows Hello for Business is straightforward, but the iPhone experience is less convenient. Our users already use push notifications through Microsoft Authenticator, so ideally I'd like them to store and use passkeys there. However, the normal setup flow often offers iCloud Keychain, which fails in our environment, while using Authenticator requires enabling it as an autofill provider. That makes regular password autofill more cumbersome because users must choose between multiple providers. Is there a smoother way to provision or use Microsoft Authenticator passkeys on managed iPhones?
4 Answers
Some organizations have moved to a different authenticator because the setup feels more seamless, but changing MFA platforms has its own licensing and migration costs. If you stay with Microsoft Authenticator, documenting the QR-code enrollment flow and managing the provider settings may be the least disruptive option.
Be careful with Conditional Access policies that block security-info registration on non-corporate devices. That restriction also prevents users from registering passkeys or passwordless sign-in methods on personal iPhones, so it can create a policy conflict if some employees do not have company phones.
For Authenticator, the most reliable process is to begin passkey registration in the app rather than accepting the browser’s default iCloud Keychain prompt. The QR-code step is awkward, but users can also approve the handoff by opening Authenticator when prompted instead of scanning in some flows.
The passkey provider is partly selected by the operating system, so there may not be a way to force Authenticator from the standard browser prompt. Your practical options are either allow synced passkeys through iCloud Keychain by relaxing attestation requirements, or have users start the registration inside Microsoft Authenticator and complete it by scanning the QR code shown in the browser.
That policy decision is worth reviewing separately from the passkey experience. If personal phones are intentionally excluded, you’ll need another enrollment path for users who lack a corporate device.