Entra ID Passkeys Assessment

Introduction

Microsoft is ending its own delivery of SMS and voice for Entra ID authentication. For most users that happens on 1 February 2027. Global Administrators and external users follow on 1 July 2027. Since 1 September 2026, users who had SMS or voice enabled have also been enabled for passkeys, and Registration Campaign has been set to Microsoft managed.

Before you change passkey profiles, Conditional Access or Registration Campaign, you need to know where the tenant stands today. This toolkit gives you that picture from Microsoft Graph, as HTML reports you can take straight into a design meeting.

The Problem

Most teams start with one number from the portal and find out later that it answered a different question.

• Four numbers that do not match: configured, registered, used and in migration scope each come from a different place. Put side by side, they rarely agree.
• Registered is not used: a registration report tells you what people have set up, not what they sign in with.
• Policy is not outcome: Conditional Access, authentication strengths and Registration Campaign describe what is allowed. They do not tell you whether a user can sign in with a passkey today.
• Some accounts are only partly visible: members of restricted management Administrative Units appear in the directory, but their authentication method details can come back as access denied.
• Passkey profiles have to be read together: once there is more than one profile, you need each one's targets, attestation and authenticator restrictions in front of you before you change any of them.

Solution Overview

You run one PowerShell command against your tenant. The toolkit reads the directory, authentication methods, authentication policy and Conditional Access, and writes the results as HTML reports.

What the Assessment Answers

1. Who is in scope

Every account in the directory, with internal users, external users and disabled accounts kept apart.

2. What people have and what they use

Registered authentication methods next to successful sign-in activity, per method and per user, and the passkeys already in the tenant.

3. How the passkey policy is set up

Passkey profiles with their targets, attestation and authenticator restrictions, the Registration Campaign settings, and which policy targets still allow SMS and voice.

4. Conditional Access and authentication strengths

The Conditional Access policies and authentication strengths that affect passkey sign-in.

5. Accounts the data cannot fully see

Administrative Units and restricted management members, shown separately.

6. Password reset

Self-service password reset settings for end users and administrators.

7. Change between runs

The overview shows how the numbers have moved since earlier runs.

Bonus: Entra Passkeys Speed Date Workshop Slides

Members also get the full PDF deck from the Entra Passkeys Speed Date Workshop: 123 slides in six modules.

Who It Is For

• Identity and security teams planning the move off SMS and voice
• Consultants who assess customer tenants
• Project leads tracking the rollout

Requirements

• PowerShell 7
• Microsoft Graph PowerShell authentication module
• Application registration
• Entra ID P1 or P2

What's Included

When you access this solution through membership, you receive:

• The assessment toolkit
• Setup and run guide (PDF)
• Implementation guide and scripts reference
• Entra Passkeys Speed Date Workshop slides (PDF)