The important detail here is the scope of the failure: Passkey sign-in requests offer an old smartphone rather than a newly set up trusted phone. First determine which part still works before changing any settings.
What is actually failing?
Observed behavior: Passkey sign-in requests offer an old smartphone rather than a newly set up trusted phone. Record the exact app or device build, affected account or file, and the first time this happened. A screenshot of the error state or a short log excerpt is useful when it contains no sensitive information.
Control comparison: Inspect passkeys registered with the service and confirm the active device has a usable passkey under the intended account. Keep the account, file, network and hardware unchanged wherever the comparison permits. If the control works, the difference between the two paths is your most useful clue.
- Does this reproduce every attempt, or only after a reboot, resume, update or account switch?
- Can the affected action complete through another supported route without changing the original data?
- Is the problem limited to one file, one profile, one device or every user of the service?
Separate possible causes
Identity providers, authenticators and local device sign-in methods are independent layers. An existing credential can be valid but unavailable in the current login flow.
Focused investigation: Distinguish synced passkeys from device-bound credentials and verify account recovery methods before removing older entries. Treat this as a way to test a cause, not proof that the cause has already been established.
| What you observe | What to check next |
|---|---|
| The controlled comparison succeeds | Compare the settings, permissions or content specific to the failing path. |
| Both original and control fail | Check the shared device, account, network or service dependencies before changing the application. |
| It works only after a fresh start | Inspect background processes, cache state, session expiry or a reconnect sequence. |
Protect the current setup
Keep an already-working recovery method until a replacement has been tested. Never bypass MFA, certificate validation, account ownership or managed-device controls.
Save the current configuration, note its values, and use a harmless test item where possible. Avoid combining this repair with unrelated updates. In particular, Do not remove the last working recovery method or approve sign-ins you did not initiate.
Choose Beginner for reversible checks or Advanced for targeted diagnostics. Passkey sign-in requests offer an old smartphone rather than a newly set up trusted phone. Confirm the affected product, user account, file or device, then record the time and a screenshot without private account information. This is the baseline; do not change settings yet. Inspect passkeys registered with the service and confirm the active device has a usable passkey under the intended account. Perform the comparison with one harmless test item. Write down both the successful and failing paths so that the next action targets the actual difference. Register a new passkey on the current device, test it, then revoke only the retired device's credential from account security settings. Change one setting or workflow at a time. Preserve an easy route back to the previous configuration and allow any synchronization, indexing or activation step to complete before retesting. A new sign-in completes on the current device and no prompt is sent to the retired phone. Test the original failing situation rather than an unrelated feature. If it passes, repeat after one normal restart or reconnect; if it fails, restore temporary diagnostic settings and use the Advanced track. Distinguish synced passkeys from device-bound credentials and verify account recovery methods before removing older entries. Note which component provides the first observable failure. Avoid logging secrets, account recovery keys, authentication cookies or the contents of private documents. Use the least invasive diagnostic appropriate to Passkey Approval Prompts Continue Going to a Retired Phone. Compare the result with the supported control path: Inspect passkeys registered with the service and confirm the active device has a usable passkey under the intended account. If there are policy restrictions, involve the administrator rather than bypassing them. Register a new passkey on the current device, test it, then revoke only the retired device's credential from account security settings. Tie any configuration change to a specific observation. If the result is ambiguous, collect additional evidence instead of layering new resets onto an unexplained problem. A new sign-in completes on the current device and no prompt is sent to the retired phone. If this does not pass, reverse temporary changes. Safety limit: Do not remove the last working recovery method or approve sign-ins you did not initiate. Provide support with the error text, environment version and reproducible comparison; do not submit private tokens or user data.Step-by-Step Troubleshooting
Capture the exact symptom
Use a supported comparison
Apply the narrow repair
Test the original workflow
Establish the failing boundary
Collect focused diagnostics
Validate the likely cause
Restore and escalate safely
Solution Checklist
Avoid these shortcuts
- Do not remove the last working recovery method or approve sign-ins you did not initiate.
- Do not treat a successful unrelated feature as evidence that the failing action is fixed; run the original comparison again.
- Do not erase logs, synced files or working credentials before you know which layer was responsible.
Confirm the outcome
Pass condition: A new sign-in completes on the current device and no prompt is sent to the retired phone. Repeat the same test using the original account, document, peripheral or network path; a passing test on a substitute is useful evidence but is not the final result.
For intermittent problems, repeat the operation after a normal application restart and again after the state change that originally triggered it, such as reconnecting a dock, signing in, or resuming from sleep. Check for new errors in the same location as the original symptom.
When troubleshooting does not help
If the controlled test still fails, return temporary settings to their earlier state and collect the minimum relevant evidence. Next diagnostic: Distinguish synced passkeys from device-bound credentials and verify account recovery methods before removing older entries. Note exactly which comparison failed and what changed after the attempted repair.
For managed devices, privacy-sensitive files, damaged storage or account security concerns, escalate to the responsible administrator or vendor with timestamps and non-sensitive logs rather than attempting a broad reset.
Keep this configuration reliable
Register more than one legitimate recovery factor, review device registrations and store recovery codes in a secure offline location.
When the system is stable, record the specific working change: Register a new passkey on the current device, test it, then revoke only the retired device’s credential from account security settings. Keep this as a reversible troubleshooting record so a later upgrade does not require repeating unrelated repair attempts.