End User Unable to Create Passkey for Entra ID Account

Question

End User Unable to Create Passkey for Entra ID Account

Alex Davis 0

Unable to Register Passkey for Entra ID Account – "Passkey not registered" Error

I have an end user who is unable to create a passkey as an authentication method for her Entra ID account, and I'm looking for guidance on next steps.

Environment

Tenant has recently enforced Phishing-Resistant MFA for all users
Device is corporate managed via Microsoft Intune (MDM)
Windows Hello for Business is configured and working
Browsers tested: Microsoft Edge and Google Chrome (both standard, non-private windows)

The Problem

One user is consistently unable to register a passkey through the Security Info page of her account settings. Her current registered methods show only a backup email, phone number, and Microsoft Authenticator — no passkeys appear, despite Windows Hello for Business being visible under the device's Passkeys settings page.

When attempting to add a new passkey, the process proceeds normally up to the naming step. After entering a name and clicking Next, the following error appears almost immediately:

"Passkey not registered. This might be due to a timeout, a canceled request, or a private browsing window."

Given how quickly the error appears, a timeout seems unlikely. The same error occurs across both Edge and Chrome.

Troubleshooting Already Attempted

Moved the user from a personal device to a corporate Intune-managed device — issue persists
Verified device registration status using dsregcmd /status — all values appear correct
Tested in both Microsoft Edge and Google Chrome
Confirmed Windows Hello for Business is set up and functioning for device login

Question

At this point I feel like I've exhausted the standard troubleshooting steps. Has anyone encountered this before, or can point me toward additional diagnostics or configuration areas to investigate?

Alex Davis 0 Reputation points

2026-03-26T14:30:21.64+00:00
Some added information:

This is only happening to this single user, all the other members of our tenant were able to successfully setup passkeys that they are using for their Microsoft Entra ID accounts

I have ensured that our FIDO2 passkey policy is setup properly within Entra ID
Carolyne 1,151 Reputation points Microsoft Employee

2026-03-30T08:50:37.2366667+00:00

Could you try to temporarily de‑scope the user from the Passkey (FIDO2) authentication method, then have them sign in and re‑register another MFA method (or issue a Temporary Access Pass), and re‑enable Passkey afterward. This has unblocked single‑user failures caused by stale or corrupted auth‑method state. Found this on this thread- https://www.reddit.com/r/entra/comments/1c4wk8w/solution_to_users_stuck_in_passkeyregistration/
Try Reset the user’s authentication methods (Entra admin center → User → Authentication methods → Require re‑register MFA), then retry passkey registration from the Security Info page. This forces Entra to rebuild the user’s passkey registration context.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-30T18:56:12.9933333+00:00

Hi Alex Davis,

Since it’s only affecting one user, this looks more like something specific to that account rather than a tenant issue.

I’d start with the sign-in logs for the failed attempt and check Authentication Details. That usually shows if a policy is blocking the request or if there’s a mismatch in the required method.

Also make sure the user is actually included in the passkey/FIDO2 targeting and not excluded anywhere, especially if Conditional Access with authentication strengths is being used.

On the device side, try from another compliant device or a fresh Windows profile. You can also remove and re-add the work account under Access work or school, then restart and try again.

Lastly, take a quick look at the user account itself for anything unusual like duplicates or a recent UPN change.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-02T18:47:31.89+00:00

Hi Alex Davis,

Please confirm if you still have further queries on this.
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator

2026-04-07T06:57:53.25+00:00

@Alex Davis, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.

Your answer

Alex Davis 0 Reputation points

2026-03-26T14:30:21.64+00:00

Some added information:

This is only happening to this single user, all the other members of our tenant were able to successfully setup passkeys that they are using for their Microsoft Entra ID accounts

I have ensured that our FIDO2 passkey policy is setup properly within Entra ID
Carolyne 1,151 Reputation points Microsoft Employee

2026-03-30T08:50:37.2366667+00:00

Could you try to temporarily de‑scope the user from the Passkey (FIDO2) authentication method, then have them sign in and re‑register another MFA method (or issue a Temporary Access Pass), and re‑enable Passkey afterward. This has unblocked single‑user failures caused by stale or corrupted auth‑method state. Found this on this thread- https://www.reddit.com/r/entra/comments/1c4wk8w/solution_to_users_stuck_in_passkeyregistration/
Try Reset the user’s authentication methods (Entra admin center → User → Authentication methods → Require re‑register MFA), then retry passkey registration from the Security Info page. This forces Entra to rebuild the user’s passkey registration context.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-03-30T18:56:12.9933333+00:00

Hi Alex Davis,

Since it’s only affecting one user, this looks more like something specific to that account rather than a tenant issue.

I’d start with the sign-in logs for the failed attempt and check Authentication Details. That usually shows if a policy is blocking the request or if there’s a mismatch in the required method.

Also make sure the user is actually included in the passkey/FIDO2 targeting and not excluded anywhere, especially if Conditional Access with authentication strengths is being used.

On the device side, try from another compliant device or a fresh Windows profile. You can also remove and re-add the work account under Access work or school, then restart and try again.

Lastly, take a quick look at the user account itself for anything unusual like duplicates or a recent UPN change.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-02T18:47:31.89+00:00

Hi Alex Davis,

Please confirm if you still have further queries on this.
Raja Pothuraju 47,820 Reputation points Microsoft Employee Moderator

2026-04-07T06:57:53.25+00:00

@Alex Davis, Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.