The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To stop a Microsoft 365 passkey registration-campaign prompt, an administrator can disable the campaign in Microsoft Entra ID or keep it enabled and configure snoozes. That only controls the campaign nudge: a separate sign-in policy, such as a Conditional Access requirement for phishing-resistant multifactor authentication, can still require passkey registration. First identify which is causing the prompt.
Identify what is prompting users
Microsoft Entra passkey prompts can come from the registration campaign, which nudges eligible users to set up a passkey or Microsoft Authenticator. They can also appear because an administrator has configured an authentication requirement. Disabling the campaign stops its nudges, not an independent requirement imposed by policy. Microsoft explains these separate causes in its Passkey FAQs and its authentication strengths documentation.
As an Amazon Associate I earn from qualifying purchases.
If a prompt persists after the campaign is disabled, review the sign-in scenario and the policies that apply to the user. In particular, check whether Conditional Access requires an authentication strength that includes phishing-resistant MFA.
Disable the registration campaign
- Open the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Registration campaign.
- Set State to Disabled and save the change.
This disables the registration campaign. It does not disable passkey authentication or remove an authentication requirement configured elsewhere. Campaign eligibility also depends on the tenant’s authentication-method configuration. See Microsoft’s registration campaign instructions.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep the campaign enabled but delay its prompts
Choose Enabled when you want to configure the campaign rather than use Microsoft-managed settings. The campaign lets an administrator choose its target method, include or exclude users and groups, and set how snoozing works.
- Days allowed to snooze: Set a value from 0 to 14 days. When the interval elapses, the user is prompted again at a later sign-in after completing MFA.
- Limited number of snoozes: When enabled, users can snooze up to three times before registration is required. When disabled, snoozing is unlimited.
A snooze delays the campaign prompt; it is not a permanent exemption. A zero-day setting provides no interval for delaying a prompt. For the exact current labels and behavior, consult Microsoft’s campaign configuration documentation.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Understand Microsoft-managed campaign settings
Microsoft managed is distinct from an administrator-configured Enabled campaign. With managed settings, Microsoft selects campaign defaults based on the tenant’s method configuration and may update those defaults. Microsoft documents a transition in managed defaults toward passkeys, one day between prompts, unlimited snoozes, and broader targeting of users who can perform MFA. Actual availability and targeting depend on eligibility, passkey-profile configuration, and rollout; check the tenant’s live campaign settings rather than assuming a particular default. See Microsoft’s authentication-method protection guidance.
Check passkey policy before changing it
The passkey authentication-method policy governs whether users can register or use passkeys; it is not just a prompt-visibility control. In the global Passkey (FIDO2) policy, Allow self-service setup controls whether users can register passkeys through Security info. Disabling a passkey type in a profile can also prevent targeted users from signing in with an already-registered passkey of that type.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Before changing these settings, consider the effect on both enrollment and sign-in. Microsoft’s instructions for enabling passkeys (FIDO2) in Microsoft Entra ID and its guidance on FIDO2 security-key sign-in to Windows describe relevant policy controls and profile behavior.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the September 1, 2026 transition date means
Microsoft’s announcement about passkeys by default and the retirement of Microsoft-provided SMS and voice authentication described September 1, 2026 as a milestone for automatic enablement of the passkey registration campaign for SMS- and voice-enabled users. It also described an opt-out using Microsoft Graph permission Policy.ReadWrite.AuthenticationMethod to delay passkey and Registration Campaign enablement while transition activities were completed.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
That announced date has passed. It does not establish whether a particular tenant changed on that day or remains eligible for an opt-out. Check the tenant’s current configuration and Microsoft’s passkeys-by-default and SMS/voice transition guidance before relying on the historical opt-out procedure.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
