Got it, makes sense. This is definitely an edge case we plan to address, being able to use a passkey in the Office apps when SSO is not present.

@crh.bsky.social and seconded what Mark said, if there's something in the guide we can make clearer please let me know

@crh.bsky.social totally hear you on the need for this and its something we'll resolve. Broad FIDO coverage on clients has some interesting technical challenges. But if you're using PSSO why do you have users re-authing in Outlook anyways? Generally they should be getting an SSO experience.

Today your options are use full MDM rather than MAM controls (auth app can satisfy full MDM compliance checks) or give the users temporary exemptions from the all apps policy that requires MAM

Not sure what you mean by safeguarded, that isn’t a concept we have in CA. MAM and passkeys can coexist on the same device just fine, but if you have an overly broad MAM CA policy then registration can be blocked, since you’re covering the reg endpoint with the overly broad CA policy.

@jeftek.com for visibility

This problem doesn't exist if you are using full MDM compliance as one of the checks instead, Authenticator can satisfy that grant control in CA. But if you are mandating app protection policy then you need to adjust your policy so that this scenario is not in scope.

This experience is expected if you have policies that require app protection policies for all cloud apps. Microsoft Authenticator doesn't support MAM policies, so you are getting the expected outcome, which is users cannot register due to not passing the app protection policy check

Innovative!

I have exactly this problem, always too lazy to dig into it

Correct, assuming these are device-bound passkeys. If they are synced, then the user can recover them through the sync process (on consumer devices, where Windows is adding sync support soon)

Inside the Windows Hello container, which is protected by the TPM

Excellent! That’s what we like to hear!

Happy to help if you’ve got questions!

I did know this!

We also recently recorded an episode of the 425 Show to talk about our new deployment guidance, so check it out to get the latest and greatest info: www.youtube.com/watch?v=5J03...