Passkey Sign‑In Fails in Entra Free Tenants (AADSTS135016 – FIDO Sign‑In Disabled via Policy)

Hello everyone,

I’m documenting an issue which seems to be appearing across multiple tenants and multiple threads, but the root cause has never been clearly stated. If I’m mistaken in any part of this analysis, my apologies and I welcome correction. This post is intended to consolidate the symptoms, the misleading error message, and the actual underlying cause so other admins don’t waste time troubleshooting a problem that cannot be fixed through configuration.

Summary of the Issue

In Microsoft Entra ID Free tenants:

• Passkeys can be enabled
• Passkeys can be registered
• Passkeys appear correctly in Security Info
• Passkeys work for MFA
• Passkeys work for self‑service setup

But passkey sign‑in fails, consistently, with:

AADSTS135016: FIDO sign‑in is disabled via policy

This occurs even when:

• FIDO2 is fully enabled
• AAGUIDs are correct
• “Allow self‑service setup” is enabled
• No Conditional Access policies exist
• Security defaults are disabled
• User‑level MFA settings are off
• Passkey profiles are correctly targeted
• Browser/device combinations are clean

Multiple admins have reported this exact behavior.

Why This Error Is Misleading

The error suggests that a policy is blocking FIDO sign‑in.

However, in Entra Free tenants, the real issue is that the required policy objects do not exist at all.

Specifically, Entra Free tenants do not include:

• Authentication Strengths
• Passwordless Strength
• Phishing‑Resistant MFA Strength
• FIDO2 Strength
• Conditional Access enforcement
• Strength‑based sign‑in policies

Passkey sign‑in requires these backend objects to bind the FIDO2 credential to the primary authentication flow. Without them, the sign‑in pipeline rejects the passkey and throws error 135016, even though registration succeeds.

This is why:

• Some tenants work (licensed)
• Some tenants fail (Entra Free)
• “Fixes” like waiting, renaming profiles, or toggling settings only work in licensed tenants where the backend policy objects exist
• No amount of configuration resolves the issue in Entra Free

This is a licensing limitation, not a configuration problem.

Why This Needs Attention

Microsoft is actively promoting:

• Passkeys
• Passwordless authentication
• Phishing‑resistant MFA
• Modern identity security

But Entra Free tenants — including personal tenants, small labs, students, developers, and home environments — cannot use passkey sign‑in at all, despite documentation implying otherwise.

This creates:

• Confusion
• Wasted time
• Misleading error messages
• Failed deployments
• Frustration for users who purchased physical passkeys
• A contradiction between Microsoft’s marketing and actual product behavior

Passkeys are a security feature, not an enterprise feature. Basic passkey sign‑in should not be locked behind Entra ID P1.

Request to Microsoft

Please consider enabling basic passkey sign‑in for Entra Free tenants.

At minimum:

• Update documentation to clearly state that passkey sign‑in requires Authentication Strengths (P1+)
• Update the error message to reflect the real cause
• Provide guidance for admins deploying passkeys in small or personal tenants

This would reduce confusion and align the product with Microsoft’s own passwordless security goals.

Closing

If anyone has additional data points, please add them here. This issue is affecting multiple tenants and deserves a clear, authoritative answer from Microsoft.

Thanks.