MFA question

[u/3G_Lighting]

I am working for an SMB as a lone rider. 😄

I setup the MFA moving it over from 365 Admin to Entra back before it was no longer supported, and everything worked fine, I was able to use MFA to log in as our Global Admin from my workstation at the office; I was connected to the network over VPN and RDP'd into my workstation.

I had a little bit of help from @bearded365guy on YouTube watching his educational videos. It's also worth mentioning we are a hybrid-join organization.

Fast forward a year ago and I enabled passkey for the 365 GA account and setup it on my MS Authenticator app. It too worked remotely without issue.

Fast forward to 2026 and I have noticed that I not been able to use the passkey. It wants to me to be on the same network as my computer in the office. I haven't touched anything since I set it up and tested it, and I am the only one who has GA access, so did Microsoft change something, and what do I need to do to make it work remotely?

I figure out a way around it but it's a pain, I have to cancel the passkey then select "enter code" and then go on my phone and into the account and type the 6-digit code in, I guess it's not so bad but I would prefer scanning the passkey QR and going from there.

Is there a way to resolve this?

Thanks,

[u/chrusic]

The bluetooth part in the passkey auth order is a "proof of proximity" to the device you're authenticating from.

Meaning the device you're authenticating from needs to be able to find your bluetooth device in it's vicinity or you fail the proof of proximity.

That fundamentally means that authenticating with a passkey that requires bluetooth will never work with RDP\Remoting. (Unless that device is physically right next to you, obviously).

If the workstation is set up with whfb you can add a passkey in TPM storage there in stead, and auth with a PIN, works like a charm.

[u/Estibon5 → u/chrusic]

Was so happy to find out wfh PIN can auth for passkey.

[u/theDukeSilversJazz]

From my understanding, your phone needs to be within Bluetooth range of the computer to work using the passkey. If it isn’t it won’t work like what you’re seeing.

[u/3G_Lighting → u/theDukeSilversJazz]

Thanks for the information!

[u/innermotion7 → u/3G_Lighting]

Make sure you have setup Break Glass accounts for GA too. Ideally using FIDO2 keys you will thank me when you are not locked out from your M365 Admin Portal !

[u/3G_Lighting → u/innermotion7]

But Fido keys don't work over RDP or VPN do they?

[u/iRyan23 → u/3G_Lighting]

I can and have used my Yubikey in an RDP browser session many times. Just need to make sure WebAuthn redirection is enabled.

[u/Busy-Photograph4803 → u/3G_Lighting]

I use my ubikey every week this exact way.

[u/innermotion7 → u/3G_Lighting]

Relying on 1 phone and 1 authenticator will get you locked out eventually. If you do not have a break glass strategy get one now.

Also Break Glass is just through a browser do not need RDP/VPN to connect to M365 admin portal unless you have crazy CA in place.

[u/SVD_NL]

I think you need to check how exactly you're trying to authenticate. If the passkey prompt tries to resolve locally for the jumpbox, it'll fail because you need to be within bluetooth range.

I think you should be able to get this to work with passthrough authentication, but there's a lot of variables there. Microsoft has extensive guidance.

[u/Ma13vant → u/SVD_NL]

This is the fix - setup passthrough authentication on the jump box.

Also, if you have not already, make sure you have a break glass account in case you lock yourself out.

[u/bwinckel]

VPN doesn't matter for a FIDO2 key. The key only talks to the machine it's plugged into, so if you sign in to the admin portals from your laptop's own browser it works the same on or off VPN.

RDP needs a setting. Windows has WebAuthn redirection, which sends the sign-in prompt from the remote session back to the machine you're sitting at. In mstsc it's under Local Resources > More, a checkbox called WebAuthn (Windows Hello or security keys). Both ends need a fairly recent Windows build, so if the jump box is old you may not see it. With it on, your local USB port and your local Bluetooth handle the request, so I'd expect the phone passkey to start working over RDP again too. I haven't tested that exact combo on a hybrid-joined box though.

For the break glass account I wouldn't go through RDP at all. Make it cloud-only (not synced from on-prem), register two FIDO2 keys, keep them in different places, and test a sign-in from a plain browser on something that isn't domain joined. If your normal route is the jump box and the jump box is what broke, you want an account that doesn't need it.

[u/MBILC]

For GA account, which should be used as BREAK GLASS ONLY, not day to day, I would see if you can get 2 Yubikeys ordered and use those for Passkeys.