Can’t add new passkeys

Authenticator may not be accepting new passkeys for several common, documented reasons:

1. Passkey already exists or is only stored locally

• During registration, a passkey can be created locally in Authenticator but fail to register on the authentication server (for example, due to a timeout or provider not being permitted).
• When trying again, Authenticator can report that the passkey already exists and block the new login.
• Fix:
  • On Android: Open Authenticator, tap the account name → Settings → Delete passkey.
  • On iOS: Open Authenticator, tap the account name → Settings → Delete passkey.
  • Then go to Security info (https://mysignins.microsoft.com/security-info) and delete any stale passkey entries for that account.
  • After cleanup, try registering the passkey again.

2. Admin policy or key restrictions blocking the passkey

• In work or school (Entra ID) tenants, admins can restrict which passkeys are allowed using the Passkey (FIDO2) policy and key restrictions.
• If the AAGUID for Microsoft Authenticator is not allowed, new passkeys in Authenticator cannot be registered or used.
• Fix (admin action):
  • In the Microsoft Entra admin center → Entra ID → Authentication methods → Authentication method policy → Passkey (FIDO2):
    • Ensure Allow self-service set up is set to Yes so users can add passkeys via Security info.
    • Under Key restrictions, either:
      • Set Enforce key restrictions to No, or
      • If Enforce key restrictions is Yes, ensure the Authenticator AAGUIDs are allowed:
        • Android: de1e552d-db1d-4423-a619-566b625cdc84
        • iOS: 90a3ccdf-635c-4729-a248-9b709135078f

3. Conditional Access policies blocking registration

• Certain Conditional Access grant controls (like Require approved client app or Require app protection policy on All resources) prevent Authenticator from being used to register passkeys.
• In that case, users cannot complete passkey registration in Authenticator, so new logins under passkey fail.
• Fix (admin action):
  • Review Conditional Access policies targeting All resources with Require approved client app or Require app protection policy.
  • Either:
    • Narrow the policy to specific apps instead of All resources, or
    • Use Require device to be marked as compliant with MDM so Authenticator can satisfy the control.

4. Platform attestation or service issues

• When attestation is enforced in the Passkey (FIDO2) policy, Authenticator relies on Apple’s iOS App Attest or Google’s Play Integrity/Key attestation.
• If those services are down or heavily loaded, passkey registration can fail and Authenticator will not accept new passkeys until the services recover.
• Fix (admin action):
  • In Passkey (FIDO2) policy, consider temporarily setting Enforce attestation to No if appropriate.
  • Monitor Apple and Google status dashboards as documented.

5. Device configuration issues (Android)

• On Android, Authenticator must be enabled as a passkey provider at OS level.
• If it is not selected, passkey creation and usage can fail.
• Fix:
  • From the passkey setup flow in Authenticator, follow the prompt to open device Settings.
  • Go to Passwords & accounts → in Additional providers, ensure Authenticator is selected as a provider.
  • Return to Authenticator and complete the passkey creation.

6. Passkey deleted or no longer valid

• If a passkey was deleted from the account or became invalid, sign-in attempts with that passkey will fail with messages like “passkey can no longer be used” or “not found.”
• Fix:
  • Remove any obsolete passkeys from the Authenticator app.
  • Set up a new passkey and then remove any old passkeys from the account’s security info.

If the environment is a work or school tenant, both user-side cleanup (deleting and re-adding passkeys) and admin-side checks (Passkey (FIDO2) policy, key restrictions, Conditional Access) are required to ensure Authenticator can accept new passkey logins.

References:

• Register passkeys in Authenticator on Android or iOS devices
• Troubleshoot signing in with a passkey
• Enable passkeys in Authenticator
• Support passkeys in Authenticator in your Microsoft Entra ID tenant