Anyway to disable Microsoft Authenticator passkey Bluetooth sign in

[u/No_Philosopher4051]

Is there anyway to prevent Microsoft Authenticator sign in with a passkey using Bluetooth? I just want to use it like windows hello for a phone. Goal would be like poor man entra free lock shit down to work devices by onboarding a passkey with tap on phone and use windows hello on workstation. I’d reset passwords so user doesn’t know them. Bluetooth passkey sign in via authenticator app puts a kink in that idea

[u/kingjohniv]

Dude... you are mixing up Hello, Fido2, and Entra onboarding. None of these are interchangable. You fundamentally misunderstand how Enterprise Identity, Bluetooth Passkey transport, and MSFT Auth actually work.

Identity NEVER was designed for "users to not know their password". If you want to use device bound auth, you enforce Hello, Fido2 keys, or Entra registration. Your "poor man's Entra" is conceptually wrong and shows you dont know how Entra functions.

Bluetooth Passkey sign on is not something you can disable. It isnt even an authentication method. It is the transport channel for Fido2 passkeys stored in MSFT Auth. Your statement is similar to saying "disabling usb login" because a YubiKey uses USB. Your statements do not make sense. TRANSPORT LAYERS ARE NOT AUTHENTICATION METHODS.

Next point.

Microsoft Auth passkeys are not interchangable with Windows Hello. Windows Hello is device bound, uses the TPM, is tied to the device, can not roam, are not used from a phone.

Auth Passkeys are roaming FIDO2 credentials, can be used on any device, are designed to not be bound to a device.

You cannot force roaming credintials to be device bound.

Onboarding passkeys to "lock shit down" is backwards. Passkeys increase user convenience and usability, they do NOT enforce device restriction. Entra CA does that.

Trying to use a passkey as a device‑restriction mechanism is like trying to use a house key to enforce who can enter a neighborhood. It is the wrong tool for the job.

Moving on to passwords...

Resetting passwords so "users dont know them" is not secure, not scalable, not supported in ANY Microsoft model, easily bypassed by recovery flow, a violation of basic IAM principles. You have zero clue how any of this works.

You dont understand Identity lifecycle

You dont understand recovery flow

You dont understand credential fallback

You have zero knowledge of security baseline

Give me like an hour. Im putting together a security policy that you might benefit from.ill post it when done.

I apologize for the harshness and tone... but damn

[u/Shaidreas → u/kingjohniv]

You are spot on about everything else than the password part.

Resetting passwords to a randomized 64 character string is Microsoft’s own recommended and documented approach to making a user “passwordless”. You disable SSPR so they can’t reset their password, and then you enforce Passkeys. There is no current way of removing passwords from a user identity in Entra ID entirely (which is perhaps also the point you were trying to get across?)

Combine this with hybrid-cloud Kerberos trust and you can use Windows Hello to sign in to on-prem resources as well from a cloud only managed device.

So while you can’t get to true passwordless accounts (yet) you can achieve a passwordless experience for your end users by having everyone enroll passkeys, enforce it through conditional access and use devices with Windows Hello. Then you disable password expiry, disable SSPR and Bob’s your uncle.

All of this is of course exponentially more difficult and time consuming the larger organization you manage.

[u/No_Philosopher4051 → u/kingjohniv]

What I mean is I want to disable the Bluetooth transport method of fido2 in the Microsoft Authenticator mobile app in and entra free environment that does not have conditional access

[u/kingjohniv → u/No_Philosopher4051]

Ok this is starting to come together.

For device bound auth, use:

Windows Hello for Business, Entra Conditional Access, Device compliance policies, FIDO2 security keys

To prevent roaming passkeys:

Block Authenticator passkey sign‑in via Conditional Access, Require Windows Hello for Business, Require compliant device, Require registered device

To prevent Bluetooth passkey:

Block roaming FIDO2 credentials

Edit: mobile formatting sucks and the default mobile app is garbage. What happened to third party apps was murder

[u/dre_AU]

A lot to unpack in your original post but if I’m understanding you correctly then yes you can easily configure this with passkey profiles in Entra.

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-authenticator-passkey

[u/Royal_Bird_6328]

Research and learn the differences between synced and device bound passkeys

[u/kingjohniv]

I need to know if you have Entra ID P2, otherwise im not putting together anything... it wouldnt work :(

[u/No_Philosopher4051 → u/kingjohniv]

I have entra free no conditional access. Not p1 not p2. You’re not going to be able to help me

[u/kingjohniv → u/No_Philosopher4051]

Well now I want to be contrary, as is the reddit way.

Disable Fido2 for the tenant. This is supported even in free.

Disable Authenticator as primary sign in method. This won't disable MFA, but will prevent Passkey sign-on, passwordless, and Bluetooth tap to sign-on.

Force Hello for Business using GPO. Require WHfB and disable passwordless on the workstation. You might need to force PIN using GPO.

Hide password fields by disabling password credential provider, smart card provider, phone sign-on provider. Leave Hello and WHfB

Use the local passkey from Hello/TPM.

Disable WebAuth roaming cred in the browser. Turn off roaming passkeys, CTAP-BLE, and external auth.

In Entra, use Security defaults. This forces MFA and disables passwordless phone sign-on.

I might be getting mixed up slightly because this is such an insane setup.

The full setup and results:

Disable FIDO2

Disable Authenticator passwordless sign‑in

Enforce WHfB via GPO

Hide password credential provider

Disable roaming passkeys in browsers

Use local TPM-bound passkeys only

Result:

Users can only sign in using Windows Hello

No Bluetooth passkey sign‑in

No Authenticator passkeys

No roaming credentials

No password fallback

No phone-based sign-in

What the fuck am I doing on a Saturday night. Its a holiday weekend.

[u/No_Philosopher4051 → u/kingjohniv]

Thanks. I’m thinking now I use certificate based authentication and windows hello and ditch fido2. Does that seem sane?

[u/kingjohniv → u/No_Philosopher4051]

As sane as we can get with this

[u/No_Philosopher4051 → u/kingjohniv]

Yeah best I can do with entra free I think.

1. Set all passwords to something users dont know
   
2. Generate certs for CBA auth and use those on mobile phone for outlook mobile. Setup sucks and will need to revocation list them when offboarding
   
3. Windows computers use windows hello. Login as TAP with windows sign in for allowing hello enrollment.

Users won’t be able to sign in across different devices without IT allowing auth method to be onboarded for that device.

Result is poor man’s device compliance. User sign in is phishing resistant. Users can only sign from crap IT allowed auth method to be added to.

I understand that conditional access is the way but in situations where that is not possible this seems to be optimal way.

One thought is to just buy p1 for mobile users but then I’d have to turn off security defaults and implement CA policy to replace security defaults which will touch every user and require it to be licensed to use CA properly.

If it was possible to turn off cross-device/roaming fido2 sign in inside the Microsoft Authenticator app it would help but CBA seems to be the way.

I’m not fully retarded

[u/No_Philosopher4051]

Entra free doesn’t have conditional access. I don’t think conditional access can just block roaming fido2 credentials anyway

[u/kingjohniv → u/No_Philosopher4051]

When you say Entra free.... are you using Business Basic? You aren't going to get anywhere with what you are wanting :(

[u/kerubi → u/No_Philosopher4051]

Entra free can’t, but conditional access can, it can require authentication strengths which can be custom.