Microsoft is changing how Entra ID handles MFA for people who sign in with Windows Hello for Business (WHfB) or macOS Platform Single Sign-On (PSSO).
The rollout reaches worldwide and GCC tenants starting early October 2026, with completion expected by late November.
Microsoft says the change “helps organizations expand the use of phishing-resistant authentication methods” and cuts reliance on weaker ones, according to an update tracked as MC1450134 in the Microsoft 365 Message Center Archive.
Both methods can already satisfy MFA requirements during primary sign-in. Users can still be asked to register and use another authentication method when they encounter certain step-up MFA prompts, Authentication Strength policies, or sign-in frequency checks. Once the rollout lands, WHfB and macOS PSSO will satisfy these MFA requirements without registering an additional passkey.
Users who rely on WHfB or macOS PSSO as their only registered MFA method will also be considered MFA-capable. Entra ID will stop prompting password users to register another MFA method when WHfB or macOS PSSO is already registered as their MFA credential.
There is one issue worth flagging. WHfB and macOS PSSO credentials are bound to a device, which means users may be unable to complete an MFA challenge from another device where the credential is unavailable.
Microsoft recommends that users register a portable MFA method for these situations, such as a synced passkey or a passkey stored in Microsoft Authenticator.
No configuration changes are required for the rollout, which is good news for admins. Organizations should still review onboarding and MFA registration processes, as well as Authentication Strength policies, before deployment.