In this blog post Why Entra Passkey Profiles May Leave Admins Open to Phishing we will explain how profile assignments work, where hidden gaps appear, and what to check before assuming your administrators are protected.
You may have enabled passkeys, created a stricter profile for administrators and confirmed that multi-factor authentication is active. On paper, the job looks finished. In practice, an administrator may still be able to register an unintended passkey or sign in using a method that can be captured by a convincing phishing attack.
The key point is simple: making passkeys available is not the same as requiring phishing-resistant authentication. Entra passkey profiles control which passkeys people can register and use, while Conditional Access controls what sign-in strength they must provide when accessing company systems.
What is an Entra passkey profile?
Microsoft Entra ID is the identity service behind Microsoft 365 and many other business applications. It decides who can sign in, which authentication methods they can use and what resources they can access.
CPI Consulting helps organisations design, build and secure Azure AI solutions, from Azure OpenAI and Microsoft Foundry to agents, governance and production deployment.
Visit CPI ConsultingA passkey replaces a reusable password with a pair of cryptographic keys. The private key stays inside a security key, phone, computer or passkey provider, while Microsoft holds the matching public key.
When someone signs in, Microsoft sends a one-time challenge that can only be answered by the correct private key. The passkey is also tied to the genuine Microsoft sign-in service, so a fake login page cannot simply collect and reuse it.
An Entra passkey profile is a set of rules describing which passkeys a group may register and use. A profile can control:
- Whether device-bound passkeys, synced passkeys or both are allowed.
- Whether attestation is required to verify the type of authenticator being registered.
- Whether particular security key models or passkey providers are allowed or blocked.
- Which users or security groups receive the profile.
This flexibility is useful because a general employee and a Global Administrator do not carry the same business risk. The problem appears when several profiles apply to the same person.
The strictest profile does not automatically win
Many IT teams assume Microsoft will see two applicable profiles and enforce the stricter one. That is not a safe assumption.
Passkey permissions can combine across applicable profiles. If an administrator belongs to a tightly controlled admin group but also remains covered by a broad profile that allows synced passkeys, the broader permission may still give that administrator more registration options than intended.
We explored this policy-overlap problem in more depth in why Entra passkey policies can leave admin accounts exposed. The practical lesson is that group membership matters just as much as the settings visible inside the dedicated admin profile.
Not every passkey carries the same administrative assurance
Both synced and device-bound passkeys are designed to resist remote phishing. However, they do not give a business the same level of control over where the credential is stored.
A device-bound passkey stays on one physical authenticator, such as an approved FIDO2 security key or a passkey held securely in Microsoft Authenticator. FIDO2 is the open security standard that allows passwordless sign-in using cryptographic keys rather than reusable passwords.
A synced passkey is encrypted and copied through a cloud passkey provider so it can be available on several trusted devices. This is convenient for employees and can reduce support costs when someone replaces a phone or laptop.
For a normal employee, that convenience may be an acceptable trade-off. For an administrator who can change security policies, access sensitive information or create new accounts, many organisations will want a device-bound credential with tighter controls.
Microsoft recommends considering device-bound passkeys for administrators and other highly privileged users. The business outcome is not simply stronger technology. It is a smaller chance that one compromised personal account, unmanaged device or recovery process leads to control of your Microsoft environment.
Attestation helps prove what is being registered
Attestation is a verification process that helps Entra confirm what kind of authenticator is creating the passkey. In plain English, it helps prevent an unapproved product from claiming to be one of your trusted security keys.
Entra can also use an Authenticator Attestation GUID, usually shortened to AAGUID. This is an identifier associated with a model or type of authenticator, allowing your organisation to approve specific security keys or passkey providers.
For privileged accounts, a sensible profile might require device-bound passkeys, enforce attestation and allow only approved authenticators. Restrictions should be tested carefully, however, because an incorrect configuration can prevent administrators from registering a replacement credential during an emergency.
A passkey profile does not force an admin to use a passkey
This is the gap most likely to create false confidence. An administrator can have a perfectly configured passkey profile and still use a password plus a weaker second step if your access policies allow it.
Traditional methods such as SMS codes, voice calls and some approval-based prompts can be targeted by phishing, social engineering or real-time interception. Attackers may also abuse legitimate authentication flows, as discussed in our guide to AI-powered device code phishing.
To close this gap, use Conditional Access, which is Microsoft’s rule system for deciding who can access an application and what security checks they must pass. A policy protecting administrator roles should require a phishing-resistant authentication strength rather than generic MFA.
Generic MFA means any permitted multi-factor method may satisfy the rule. Phishing-resistant authentication strength limits the acceptable options to methods designed to resist credential capture and replay.
What this looks like in a 200-person business
Consider a company with 200 employees and eight administrators. Its IT provider creates an admin passkey profile that permits only approved device-bound security keys with attestation.
Those eight administrators are also members of an all-employees group covered by a broad profile that allows both device-bound and synced passkeys. The administrators can therefore receive options that the security team did not expect from reviewing the admin profile alone.
The company also has a Conditional Access policy requiring MFA for administrators, but it does not specify phishing-resistant authentication. An administrator can continue signing in with a password and an approval prompt.
The dashboard says passkeys are enabled and MFA is enforced. The actual business risk has barely changed because the strongest method is optional.
Fixing the problem does not require rebuilding Microsoft 365. The company needs to clean up overlapping group assignments, confirm the effective passkey options for each administrator and enforce phishing-resistant authentication through Conditional Access.
Seven checks your IT team should complete
- List every privileged account. Include permanent administrators, eligible roles, emergency accounts, service accounts and external support users.
- Review all group memberships. Look beyond the dedicated admin group and identify broad groups that target passkey profiles.
- Map each applicable profile. Record whether it allows synced passkeys, device-bound passkeys, attestation and specific authenticators.
- Check registered methods. Confirm what each administrator has already registered, not just what current policy allows.
- Require phishing-resistant authentication. Use Conditional Access authentication strength for administrator roles and sensitive systems.
- Protect recovery processes. Temporary Access Passes, replacement keys and help-desk verification must be controlled so attackers cannot register their own passkey.
- Test before enforcement. Use pilot accounts and maintain separately protected emergency access accounts to avoid locking your team out.
This review should sit alongside the broader controls in Microsoft Entra ID security settings every business should review.
Why this matters for Essential Eight
The Essential Eight is the Australian government’s cybersecurity framework for reducing common security risks. It covers both multi-factor authentication and the restriction of administrative privileges.
Australian Signals Directorate guidance increasingly emphasises phishing-resistant MFA, including passkeys and security keys. Simply showing that MFA is enabled may not demonstrate that privileged access is protected to the intended maturity level.
Evidence matters. Your organisation should be able to show which methods administrators can register, which methods they must use, how authentication events are logged and how exceptions are approved.
Microsoft Defender, which monitors threats across Microsoft 365, can help detect suspicious account activity and phishing attempts. Our guide to reducing phishing risk with Microsoft 365 Defender explains how those detection controls support stronger identity protection, but they should complement secure authentication rather than replace it.
Do not judge security by the profile name
A profile called Admin Security Keys Only may sound reassuring. What matters is the effective result after every group, profile, registered method and Conditional Access policy has been evaluated together.
CloudProInc approaches these reviews as a practical identity and risk exercise, drawing on more than 20 years of enterprise IT experience. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations connect Entra, Microsoft 365, Intune, Defender and cloud security controls without turning the project into a giant consulting engagement.
If you are not sure whether your administrators are genuinely required to use phishing-resistant authentication, we are happy to review the setup and explain the gaps in plain English — no strings attached.