Troubleshooting

What you see	What to do
Passkey isn't offered after pressing Start	Group membership takes a moment to reach the passkey policy. Wait two minutes and refresh.
Someone shows as Blocked	They hold a privileged role or are in your privileged or break-glass group. That's working as intended: they need a device-bound key, outside Auth-Onboard.
Status hasn't changed after they registered	Statuses update hourly from Entra's registration report. Use Check now on the person.
Emails aren't arriving	Use Send test to me in Settings. Check the sender domain is verified with your mail service and the key can send.
Someone can't create a passkey on their phone	Look for a policy requiring a compliant device or approved app on phones: the installer's review lists them.
Under device-bound passkeys, registration in Authenticator fails	Attestation relies on Apple's and Google's services. Check their status pages and try again later.

Something missing? Get in touch.