Microsoft Entra Conditional Access Blocks Passkey from New Device

The reported behavior is straightforward to observe but easy to misdiagnose: A passkey works on one laptop but new hardware receives a policy block. The aim is to identify the first failing dependency, apply only an appropriate supported change and demonstrate that the original operation works again. The tests are tied to real device behavior and supported configuration, not assumptions about a future error code.

What users actually see

A passkey works on one laptop but new hardware receives a policy block. Record whether this happens every time or only after an update, a network change or a restart. Check whether another device or a second authorized account exhibits the same behavior: that distinction can prevent an unnecessary device-wide repair.

• Record the symptom: A passkey works on one laptop but new hardware receives a policy block.
• Establish the first baseline: Record the sign-in error ID and correlation ID without tokens.
• Define a result worth accepting: Authorized sign-in succeeds and policy remains enforced for other users.

Technical explanation

Device compliance or authentication strength can differ across sign-in contexts. Authentication requires both a valid identity and permission to use the selected factor in its current context. Recovery settings, security keys, managed-device rules and browser availability may differ. Preserve the last known-good sign-in method throughout troubleshooting.

For this Microsoft Entra case, the initial explanation is only a working hypothesis: Device compliance or authentication strength can differ across sign-in contexts. Test it against the first observation, record the sign-in error ID and correlation ID without tokens. If those results do not support the suspected cause, compare the second and third checks rather than treating an update or a network connection as proof of a specific fault.

Before making changes

Confirm a backup authentication factor and organization ownership before changing sign-in policy. Never publish keys, OTPs or recovery codes. Do not create broad bypass exclusions to solve a single device registration issue.

• Record: timestamp, provider correlation ID, affected factor and non-secret account recovery options.
• Make the first check read-only: Record the sign-in error ID and correlation ID without tokens.
• Define success in advance: Authorized sign-in succeeds and policy remains enforced for other users.

How to interpret the results

If an authorized fallback factor works, identity ownership may be intact while one authentication method is blocked. If every factor fails, contact the official recovery channel. Begin with: Record the sign-in error ID and correlation ID without tokens. Check Entra sign-in logs for the exact Conditional Access policy result.

If the first check does not match the expected state, correct that dependency before proceeding. If the first check is normal but the second differs from a working baseline, focus on the second layer instead. If both appear normal, use the third test to distinguish the remaining configuration or device-specific path: Ask a tenant admin to validate registered devices and supported authentication method eligibility.

Common mistakes to avoid

• Do not create broad bypass exclusions to solve a single device registration issue.
• Changing several settings at once makes it impossible to know which adjustment mattered. Repeat the original test after each approved change.
• Assuming an online or connected indicator proves that Microsoft Entra can complete the required operation.

Verify the outcome

Authorized sign-in succeeds and policy remains enforced for other users. Re-run the same original action with the same authorized account, device or file, and compare the result with the recorded baseline. Do not declare success just because a status indicator changes color or a test utility finishes without error.

If the issue was intermittent, repeat the relevant Microsoft Entra operation at several short intervals and record times. Then perform a routine reconnect or restart only if it was associated with the original failure. In this case the confirmation is specific: Authorized sign-in succeeds and policy remains enforced for other users. If only one configuration works, document that limit and check ask a tenant admin to validate registered devices and supported authentication method eligibility. before extending the conclusion to other users or devices.

Escalation and rollback

If Microsoft Entra continues to show this behavior, stop making broad changes. Do not create broad bypass exclusions to solve a single device registration issue. Restore test settings that did not help, preserve the exact observation from record the sign-in error ID and correlation ID without tokens. and contact the relevant device vendor, service provider or organizational administrator. Include correlation IDs, date, client device, registered factor types and tested nonsecret recovery methods.

Maintenance and prevention

Keep a note of the exact Microsoft Entra configuration that produced the working result: Authorized sign-in succeeds and policy remains enforced for other users. Recheck the same operation after new devices, security key changes, tenant policies and identity-provider rollouts. For this failure, the quickest future comparison is record the sign-in error ID and correlation ID without tokens. Preserve supported settings and use vendor-approved maintenance rather than accumulating unverified resets.