Passkey sign-in works for Microsoft 365 on Windows and Apple laptops using a phone and QR code, but our Windows desktops only offer a USB security key. Bluetooth mice and keyboards work on the desktops. What should I check?
The desktops are Entra joined. A new desktop showed the same USB-only prompt during Entra join, before enrollment. Windows Hello and Windows Hello for Business are disabled, and we do not use a shared PC profile.
Start with Bluetooth Low Energy support on the desktops. A working Bluetooth mouse or keyboard does not by itself confirm that the components needed for the phone passkey flow are available and enabled.
Compare a working laptop with an affected desktop. Check the Bluetooth adapter, driver, settings, and whether the relevant BLE enumerator is present. Also look for device policies that might disable or restrict Bluetooth.
Don't assume the enrollment profile is the whole story yet. The new desktop showed the same prompt before enrollment, so I'd also compare the Entra authentication method and FIDO2 settings that apply to the test account. That observation narrows the test, but it doesn't prove a tenant policy is responsible.
Check the sign-in context separately from the Microsoft 365 browser test. The prompt during Entra join is a different flow, so a QR option appearing in the browser doesn't necessarily mean that same option will be offered there. Compare the same account and sign-in flow on a working laptop and an affected desktop if you can.
Since you aren't using a shared PC profile, that particular configuration is less likely to explain it. Still, credential provider settings are worth checking on the affected desktops if other sign-in choices seem to be missing.
Answers are reviewed before publication.
Vexra.8t:
A USB Bluetooth adapter could be a useful comparison test. If the QR option appears with it, that narrows the investigation toward the built-in adapter or its configuration.