By Sinisa Markovic
Publication Date: 2026-08-10 13:19:00
Microsoft is changing how Entra ID handles MFA for people who sign in with Windows Hello for Business (WHfB) or macOS Platform Single Sign-On (PSSO).
The rollout reaches worldwide and GCC tenants starting early October 2026, with completion expected by late November.
Microsoft says the change “helps organizations expand the use of phishing-resistant authentication methods” and cuts reliance on weaker ones, according to an update tracked as MC1450134 in the Microsoft 365 Message Center Archive.
Both methods can already satisfy MFA requirements during primary sign-in. Users can still be asked to register and use another authentication method when they encounter certain step-up MFA prompts, Authentication Strength policies, or sign-in frequency checks. Once the rollout lands, WHfB and macOS PSSO will satisfy these MFA requirements without registering an additional passkey.
Users who rely on WHfB or macOS PSSO as their only registered MFA method will also be considered…
