What people receive#
Everyone ends up with the same pair: Microsoft Authenticator (MFA, and the backup) and a passkey. Each step has its own email, sent when the hourly run sees the previous step done. Every email and page uses your branding, not ours.
| They start with | First email | Second email |
|---|---|---|
| Nothing registered | Set up Authenticator, signing in with their password at aka.ms/mfasetup | Add a passkey, once Authenticator appears |
| SMS or voice | Set up Authenticator, signing in with SMS | Add a passkey |
| A code app | Switch to Microsoft Authenticator | Add a passkey |
| Authenticator push | Skipped | Add a passkey, straight away |
How it behaves#
- The link opens a page that explains what will happen. Nothing changes until they press Start, which adds them to the onboarding group, so mail scanners opening links can't set anyone off.
- Reminders go 3 days after the invitation, then every 3 days, up to 3. Their manager gets one escalation at 14 days.
- Links expire after 21 days, and each email carries a new one.
- Under Progressive, they're promoted to the phishing-resistant group once they've signed in with a passkey, not just registered one. Windows Hello for Business doesn't count, because it's tied to one PC.
- If a promoted person no longer has a passkey, they're moved back to the onboarding group, so they aren't locked out, and asked again.
- If the install accepts device-bound passkeys only, the emails and pages tell people to save their passkey in Authenticator or on a security key.