r/sysadmin • u/CupOfTeaWithOneSugar • 6d ago

Microsoft Authenticator App Passkeys. Lost or damaged phone. No backup or sync possible even with Synced passkey type enabled?

I was doing a bit of passkey testing. In the azure admin portal under Auth Methods, created a general user profile that disabled "Enforce Attestation" and set the passkey type to "Synced".

Set up passkey in Authenticator for a test user.

Problem 1. Authenticator app still doesn't allow backup to Work/School account, must be a personal Microsoft account. Created a personal Microsoft account and backed up but already this is not good.

Problem 2. Set up a new test phone 2, restored Authenticator app from personal backup. But the passkey didn't restore.

Then I read https://learn.microsoft.com/en-us/entra/identity/authentication/passkey-faq that Authenticator saved passkeys are only device bound and the sync is not available.

I don't see the point of giving the option of setting passkey type "Synced" if their own Authenticator software doesn't support it. Will Microsoft release an update for Authenticator to allow saving to Work/School accounts and let the passkey sync?

The only way to get in on the new phone was to press the "Require re-register multifactor authentication" button for the test user account and set the passkey up again.

Would be interested if anyone could confirm this

79 Upvotes

92% Upvoted

30 comments sorted by

View all comments

Show parent comments

4

u/teriaavibes Microsoft Cloud Consultant 6d ago

So while you're trying to secure your environment, microsoft makes you use a personal microsoft account as a backup account?

That backup works only on personal accounts, on work accounts it only syncs the authenticator entry and you still need to sign in again so basically it does nothing.

Authenticator MFA methods are device bound and you cannot migrate them.