{"id":59369,"date":"2026-10-24T09:02:12","date_gmt":"2026-10-23T23:02:12","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/24\/why-entra-passkey-policies-can-leave-admin-accounts-exposed\/"},"modified":"2026-10-24T09:03:52","modified_gmt":"2026-10-23T23:03:52","slug":"why-entra-passkey-policies-can-leave-admin-accounts-exposed","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/24\/why-entra-passkey-policies-can-leave-admin-accounts-exposed\/","title":{"rendered":"Why Entra Passkey Policies Can Leave Admin Accounts Exposed"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post <strong>Why Entra Passkey Policies Can Leave Admin Accounts Exposed<\/strong> we will explain why overlapping Microsoft Entra passkey profiles can quietly give administrators more sign-in options than intended, and how to close the gap without disrupting staff.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">The problem is easy to miss. Your IT team may create one convenient passkey policy for employees and a stricter policy for administrators, reasonably assuming that anyone covered by both will receive the stronger protection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is not how Entra evaluates these profiles. If a passkey meets the requirements of <em>any<\/em> profile assigned to the user, it can be allowed. In plain English, the policies work like an \u201cor\u201d, not an \u201cand\u201d.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Entra passkeys and profiles actually do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Entra ID is the identity service behind Microsoft 365 and many Azure applications. It checks who a user is and helps decide what they can access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A passkey replaces a reusable password with a protected digital credential. The user confirms their identity with a fingerprint, facial recognition, device PIN or physical security key, but the secret itself is not typed or sent to a website. This makes passkeys far more resistant to phishing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Entra passkey profiles let organisations set different rules for different groups. A profile can control whether passkeys are synced between a person\u2019s devices, tied to one device, or restricted to approved authenticator models.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Synced passkeys are convenient because they can follow the user through services such as a supported password manager. Device-bound passkeys remain attached to a particular device or physical security key, giving the organisation tighter control.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For most employees, synced passkeys can reduce password resets and frustrating sign-in prompts. For administrators with access to critical systems, device-bound credentials are often the safer choice.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The hidden gap created by overlapping groups<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine that your company creates the following profiles:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Standard employee profile\nTarget group: All Staff\nAllowed: Synced and device-bound passkeys\n\nPrivileged administrator profile\nTarget group: Privileged Admins\nAllowed: Approved device-bound passkeys only\nAttestation: Required during registration\n\nUser: Alice\nGroup membership: All Staff and Privileged Admins\n\nExpected result: Device-bound passkeys only\nActual result: Either profile can allow the passkey<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Attestation is a check that helps Entra confirm the type and origin of an authenticator. It can be used to ensure administrators register an approved physical key or another trusted device-bound credential.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The configuration looks sensible when viewed profile by profile. The administrator policy is strict, documented and assigned to the correct group.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, Alice is also covered by the standard employee profile. If her synced passkey fully satisfies that more permissive profile, Entra does not combine both profiles and apply the strictest settings. Satisfying one applicable profile can be enough.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the union behaviour. The available options from overlapping profiles are effectively added together rather than narrowed to the shared, strictest result.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why this matters to business leaders<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Your highest-impact accounts may have weaker controls<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker who compromises an ordinary employee account may gain access to email and files. An attacker who compromises a privileged administrator can potentially change security controls, create accounts, access sensitive systems or interfere with incident response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That is why administrator protection should not depend on a broad employee policy behaving more restrictively than it actually does.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Your compliance evidence may not match reality<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A policy screenshot showing \u201cdevice-bound passkeys only\u201d for administrators is not proof that every administrator is restricted to those credentials. Group overlap and the user\u2019s effective policy also need to be examined.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is relevant to the Essential Eight, the Australian Signals Directorate\u2019s cybersecurity framework used as a baseline by many Australian organisations. It places strong emphasis on multi-factor authentication and restricting administrative privileges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Passkeys can support those goals, but only when the policy design produces the intended result for real users. An auditor or customer assurance team will increasingly want evidence of the effective control, not simply evidence that a policy exists.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">You can gain false confidence from a successful rollout<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A smooth rollout is not always a secure rollout. If administrators can register an easier credential through a broad staff profile, support tickets may be low while the most important security requirement remains unmet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is similar to the issue covered in the Intune policy gap that leaves company devices exposed. A green status in an administration portal does not necessarily mean the effective control is correct.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A realistic 200-person business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider an Australian professional services company with 200 employees, six IT administrators and several external support accounts. The business enables synced passkeys for everyone to reduce password resets and make mobile sign-in easier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The IT team then creates a second profile requiring approved device-bound passkeys for the administrator group. They assume the more specific administrator profile overrides the general employee profile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During a review, the company discovers that five administrators remain members of both target groups. Their synced credentials can still satisfy the employee profile, so the intended administrator restriction is not reliably achieved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">No breach is required for this to become expensive. The business must investigate existing credentials, redesign groups, retest Conditional Access and produce updated compliance evidence under time pressure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to close the gap without breaking sign-in<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Map every passkey profile and target group<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">List each profile, what it permits and which groups receive it. Pay particular attention to broad targets such as All Users, All Staff, contractors and company-wide dynamic groups.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then identify people who sit in more than one profile. Start with Global Administrators, Privileged Role Administrators, security administrators and accounts used by external IT providers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Build mutually exclusive user groups<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid targeting a convenient staff profile at everyone when privileged users need different rules. Create clearly owned groups for standard users and privileged identities, with a process that prevents administrators from drifting back into the broader profile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Group membership must be reviewed whenever someone receives or loses an administrative role. Otherwise, today\u2019s clean design becomes next quarter\u2019s hidden exception.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Enforce privileged access with Conditional Access<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Conditional Access is Entra\u2019s rule engine for deciding whether a sign-in should be allowed. Use it to require a suitable authentication strength for administrator portals, sensitive applications and privileged actions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An authentication strength defines which sign-in methods are acceptable. For privileged access, this may include limiting passkeys to approved device-bound authenticator identifiers rather than accepting any FIDO2 passkey.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not assume that selecting the general \u201cpasskey\u201d method automatically separates synced and device-bound credentials. Test the exact authenticators you expect administrators to use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Changes should begin in report-only mode, where Entra records what would happen without blocking users. Our guide to cleaning up Conditional Access without locking out users provides a practical process for doing this safely.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Test people, not just policies<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Select test accounts representing employees, administrators, contractors and emergency access users. Confirm which credentials each account can register and which credentials can actually open sensitive services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Review sign-in logs after testing. This shows the authentication method used and whether the intended Conditional Access control was applied.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Review existing registered passkeys<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fixing group assignments does not remove the need to inspect credentials already registered to privileged users. Identify unexpected passkeys, remove credentials that no longer meet your standard and give administrators a controlled recovery process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Emergency access accounts also require careful handling. They should not become everyday exceptions that quietly bypass the controls protecting everyone else.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The question leaders should ask their IT team<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do not ask only, \u201cDo our administrators have a stricter passkey policy?\u201d Ask, \u201cCan you show me the effective passkey options for an administrator who belongs to every relevant group?\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That question moves the conversation from configuration to outcome. It also complements the checks in our guide to Conditional Access mistakes that put Microsoft 365 at serious risk.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Strong authentication needs joined-up policy design<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Passkeys can reduce phishing risk, support Essential Eight goals and make sign-in easier. But a stricter profile does not automatically override a broader one when the same person is covered by both.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The safest approach combines clean group design, device-bound credentials for privileged users, carefully tested Conditional Access and regular reviews of registered authentication methods.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc brings more than 20 years of enterprise IT experience to Microsoft Entra, Azure, Microsoft 365, Intune, Defender and wider cybersecurity projects. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we focus on practical reviews rather than handing clients a generic policy document.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not sure whether your Entra passkey policies protect administrators the way your team expects, we are happy to review the effective setup and explain any gaps in plain English \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Overlapping Entra passkey profiles can quietly weaken protection for administrators. Learn why the strictest policy does not automatically win and how to close the gap.<\/p>\n","protected":false},"author":1,"featured_media":59371,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[13,107,36,103],"tags":[],"class_list":["post-59369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-cybersecurity","category-entra-id","category-essential-8"],"jetpack-related-posts":[{"id":57894,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/what-to-do-about-sms-and-voice-mfa-in-microsoft-entra-by-2027\/","url_meta":{"origin":59369,"position":0},"title":"What to Do About SMS and Voice MFA in Microsoft Entra by 2027","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Microsoft is retiring native SMS and voice MFA in Entra ID. Here is what Australian businesses should check now to avoid sign-in disruption and reduce phishing risk.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/what-to-do-about-sms-and-voice-mfa-in-microsoft-entra-by-2027.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/what-to-do-about-sms-and-voice-mfa-in-microsoft-entra-by-2027.png 1x, \/wp-content\/uploads\/2026\/07\/what-to-do-about-sms-and-voice-mfa-in-microsoft-entra-by-2027.png 1.5x, \/wp-content\/uploads\/2026\/07\/what-to-do-about-sms-and-voice-mfa-in-microsoft-entra-by-2027.png 2x, \/wp-content\/uploads\/2026\/07\/what-to-do-about-sms-and-voice-mfa-in-microsoft-entra-by-2027.png 3x, \/wp-content\/uploads\/2026\/07\/what-to-do-about-sms-and-voice-mfa-in-microsoft-entra-by-2027.png 4x"},"classes":[]},{"id":58354,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/microsoft-entra-id-security-settings-every-business-should-review\/","url_meta":{"origin":59369,"position":1},"title":"Microsoft Entra ID Security Settings Every Business Should Review","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Most Microsoft 365 breaches begin with a stolen or overprivileged identity. Review these Entra ID settings to reduce risk, support Essential 8 and avoid costly access failures.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/microsoft-entra-id-security-settings-every-business-should-review.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/microsoft-entra-id-security-settings-every-business-should-review.png 1x, \/wp-content\/uploads\/2026\/08\/microsoft-entra-id-security-settings-every-business-should-review.png 1.5x, \/wp-content\/uploads\/2026\/08\/microsoft-entra-id-security-settings-every-business-should-review.png 2x, \/wp-content\/uploads\/2026\/08\/microsoft-entra-id-security-settings-every-business-should-review.png 3x, \/wp-content\/uploads\/2026\/08\/microsoft-entra-id-security-settings-every-business-should-review.png 4x"},"classes":[]},{"id":59348,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/23\/choose-your-own-telephony-in-microsoft-entra-without-the-risk\/","url_meta":{"origin":59369,"position":2},"title":"Choose Your Own Telephony in Microsoft Entra Without the Risk","author":"CPI Staff","date":"October 23, 2026","format":false,"excerpt":"Microsoft is ending native SMS and voice delivery in Entra. Learn when third-party telephony makes sense, the risks to manage, and what to check before rollout.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/choose-your-own-telephony-in-microsoft-entra-without-the-risk.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/choose-your-own-telephony-in-microsoft-entra-without-the-risk.png 1x, \/wp-content\/uploads\/2026\/10\/choose-your-own-telephony-in-microsoft-entra-without-the-risk.png 1.5x, \/wp-content\/uploads\/2026\/10\/choose-your-own-telephony-in-microsoft-entra-without-the-risk.png 2x, \/wp-content\/uploads\/2026\/10\/choose-your-own-telephony-in-microsoft-entra-without-the-risk.png 3x, \/wp-content\/uploads\/2026\/10\/choose-your-own-telephony-in-microsoft-entra-without-the-risk.png 4x"},"classes":[]},{"id":57511,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/the-microsoft-365-tenant-looked-fine-until-we-checked-the-security-defaults\/","url_meta":{"origin":59369,"position":3},"title":"The Microsoft 365 Tenant Looked Fine Until We Checked the Security Defaults","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Every Microsoft 365 tenant tells a story. Emails flowing, Teams meetings running, SharePoint humming along. From the outside, everything looks operational. But operational is not the same as secure \u2014 and the gap between those two things is where breaches happen. When our team conducts a Microsoft 365 security assessment,\u2026","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/04\/the-microsoft-365-tenant-looked-fine-until-we-checked-the-security-defaults-cover.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/04\/the-microsoft-365-tenant-looked-fine-until-we-checked-the-security-defaults-cover.png 1x, \/wp-content\/uploads\/2026\/04\/the-microsoft-365-tenant-looked-fine-until-we-checked-the-security-defaults-cover.png 1.5x, \/wp-content\/uploads\/2026\/04\/the-microsoft-365-tenant-looked-fine-until-we-checked-the-security-defaults-cover.png 2x, \/wp-content\/uploads\/2026\/04\/the-microsoft-365-tenant-looked-fine-until-we-checked-the-security-defaults-cover.png 3x, \/wp-content\/uploads\/2026\/04\/the-microsoft-365-tenant-looked-fine-until-we-checked-the-security-defaults-cover.png 4x"},"classes":[]},{"id":58407,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-defender-intune-and-entra-id-secure-microsoft-365-together\/","url_meta":{"origin":59369,"position":4},"title":"How Defender Intune and Entra ID Secure Microsoft 365 Together","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"See how Defender, Intune and Entra ID share security signals to block risky access, protect devices and support Essential 8 without creating unnecessary friction.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/how-defender-intune-and-entra-id-secure-microsoft-365-together.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/how-defender-intune-and-entra-id-secure-microsoft-365-together.png 1x, \/wp-content\/uploads\/2026\/08\/how-defender-intune-and-entra-id-secure-microsoft-365-together.png 1.5x, \/wp-content\/uploads\/2026\/08\/how-defender-intune-and-entra-id-secure-microsoft-365-together.png 2x, \/wp-content\/uploads\/2026\/08\/how-defender-intune-and-entra-id-secure-microsoft-365-together.png 3x, \/wp-content\/uploads\/2026\/08\/how-defender-intune-and-entra-id-secure-microsoft-365-together.png 4x"},"classes":[]},{"id":56890,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/implement-zero-trust-with-entra-id-and-intune\/","url_meta":{"origin":59369,"position":5},"title":"Implement Zero Trust With Entra ID and Intune","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn how to implement Zero Trust using Microsoft Entra ID and Intune with practical steps, key policies, and rollout tips. Secure access and devices without slowing users down.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/01\/post-5.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/01\/post-5.png 1x, \/wp-content\/uploads\/2026\/01\/post-5.png 1.5x, \/wp-content\/uploads\/2026\/01\/post-5.png 2x, \/wp-content\/uploads\/2026\/01\/post-5.png 3x, \/wp-content\/uploads\/2026\/01\/post-5.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/10\/why-entra-passkey-policies-can-leave-admin-accounts-exposed.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59369"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59369\/revisions"}],"predecessor-version":[{"id":59370,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59369\/revisions\/59370"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59371"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}