Free, offline tool: see each user's real passkey policy in Entra ID and who SMS retirement blocks

Entra combines passkey profiles as a union (any profile that allows a passkey type wins), while Conditional Access works as an intersection. So a Global Admin in a strict "security keys only" profile who is also in an All Users profile can still register a synced iCloud or Google passkey, and the portal never shows you that per user.

I built EffectivePasskey to answer three questions for every user and admin:

1. What passkey can this person actually register?

2. What can this admin actually sign in with after Conditional Access?

3. Who gets blocked when SMS and voice MFA retire (1 Feb 2027, and 1 Jul 2027 for Global Admins)?

It runs entirely on your machine from read-only JSON exports. It never signs in to your tenant and never changes anything. No telemetry. MIT licensed and completely free.

Try it with the included demo tenants:

pip install effective-passkey

GitHub: https://github.com/xsignon-secure/EffectivePasskey

Feedback and issues are very welcome, especially from anyone mid-rollout.