Entra ID - Federation or EAM for Passkey deployment

Adding to the good answer above, here are a few points that usually decide this:

1. On authentication strength for EAM: External MFA (the GA name for EAM) satisfies the "Require multifactor authentication" grant, including PIM and device registration. It is still not supported in authentication strengths, built-in or custom. Microsoft hasn't committed to a date, so don't plan around it.

2. Option 1 (replace ADFS with third-party federation) keeps you federated. Entra then never sees the first factor, Entra-native passkeys and phishing-resistant strengths become harder to enforce, and you swap one IdP dependency for another. Option 2 is the long-term direction.

3. A practical sequence:

- Enable password hash sync now, even if you stay federated for a while. It's your break-glass path if ADFS fails, and Entra ID Protection needs it to detect leaked credentials.

- Use staged rollout by group, pilot first. Groups can be rolled back.

- Keep the third party as External MFA so users notice almost nothing.

- Then enable Entra passkeys (Authenticator or FIDO2) with passkey profiles. Require the "Phishing-resistant MFA" strength for admins and high-risk groups first. That needs P1, not P2.

- As users register passkeys, External MFA becomes a fallback and you can reduce it over time.

4. If you don't have P2: risk-based CA needs P2. Many tenants cover the gap with compliant/hybrid-joined device requirements, token protection where supported, short sign-in frequency for admins, and sign-in logs streamed to a SIEM. Buying P2 only for privileged users is also allowed.

5. Pitfall: if users are enabled for SMS/voice, passkey auto-enablement since September 1, 2026 can add an "all passkey types" profile on top of yours. Check before the pilot, because it can let synced passkeys through.

Docs: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider and https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-staged-rollout