opt-out passkeys for September 1st

Question

opt-out passkeys for September 1st

Thomas Wrobel 0

Having issues with opt-out of passkeys commands using powershell 7 .. cannot successfully run the

Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy" -Body $body -ContentType "application/json"

or

Verify

(Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy").optOutSettings

0 comments

1 answer

Your answer

Answer 1

Hi @Thomas Wrobel

For the temporary September 1, 2026 passkey opt-out, Microsoft requires the Policy.ReadWrite.AuthenticationMethod Graph permission and the signed-in user should have at least the Authentication Policy Administrator role.

In PowerShell 7, try the following:

Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"

$body = @{

optOutSettings = @{

    passkeyDynamicMigration = $true

}

} | ConvertTo-Json -Depth 5

Invoke-MgGraphRequest `

-Method PATCH `

-Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy" `

-Body $body `

-ContentType "application/json"

Then verify with:

$result = Invoke-MgGraphRequest `

-Method GET `

-Uri "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy"

$result.optOutSettings

You should see:

passkeyDynamicMigration : True

Microsoft specifically documents passkeyDynamicMigration: true as the temporary opt-out mechanism for the September 1, 2026 to February 1, 2027 transition. There is no opt-out after February 1, 2027.

If it still fails, please share the actual HTTP/Graph error returned by Invoke-MgGraphRequest, as that will help determine whether it is a permissions, consent, or API-side issue.

If this helps resolve your issue, please don’t forget to mark the answer as Accepted / Resolved.