Postures and Conditional Access#
The posture decides where people are steered and which Conditional Access strength applies. You choose it when you install and can change it later.
| Posture | People are steered to | Conditional Access |
|---|---|---|
| Progressive (recommended) | Authenticator, then a passkey | MFA-StandardUsers while onboarding; phishing-resistant MFA once promoted |
| Passkey first | A passkey, with Authenticator as the fallback | MFA-StandardUsers |
| MFA only | Microsoft Authenticator | MFA-StandardUsers |
| Passkey only | A passkey only | Phishing-resistant MFA (needs a Temporary Access Pass process for people with nothing registered) |
The state policies are created in#
- The onboarding policy is created On: its group starts empty and people join only when they press Start.
- The promoted policy is created On too, because its group only ever holds people who've signed in with a passkey.
- The exception is the Passkey only posture's onboarding policy, which starts in report-only: people join before they have a passkey, and a Temporary Access Pass doesn't satisfy the phishing-resistant strength.
Your existing policies#
Your existing policies are never changed. Conditional Access policies stack, so Auth-Onboard's can only add a requirement. The installer warns you about two combinations that cause trouble:
- a policy requiring a compliant device or approved app on phones: people can't create a passkey in Authenticator on a personal phone;
- a custom authentication strength that doesn't accept passkeys.
Passkeys: synced, or device-bound with attestation#
| Option | Accepts | Trade-off |
|---|---|---|
| Synced or device-bound (default) | Passkeys in Authenticator, on a security key, or synced with iCloud Keychain, Google Password Manager or a password manager. No attestation. | Easiest for people, and a passkey survives a lost phone. Entra can't vouch for a synced passkey: the person's Apple, Google or password-manager account becomes part of your security. |
| Device-bound only, with attestation | Microsoft Authenticator and FIDO2 security keys, checked against Microsoft's list when they're registered. | Stronger assurance. A lost phone means a new passkey and a Temporary Access Pass from your service desk, and registration in Authenticator depends on Apple's and Google's attestation services being up. |
Emails and enrol pages follow the choice: under device-bound, people are told to save the passkey in Authenticator or on a security key.
Switching an existing install to device-bound
Existing synced passkeys stop working for people in the groups. The installer warns you and waits for your confirmation. Going the other way affects nobody.