Synced iCloud Keychain passkey registration succeeds despite Device-Bound-only passkey profile

Your device-bound pilot profile can be correct while the same user is still allowed to register an iCloud-synced passkey through another applicable profile. Microsoft documents that overlapping passkey profiles are evaluated without priority: registration or authentication succeeds when the credential fully satisfies any one applicable profile. Microsoft also documents automatic passkey enablement for SMS/voice-enabled users from September 1, 2026, using a profile permitting all passkey types. That matches the additional profile described in your banner, rather than proving your AAGUID restrictions were ignored. Check the pilot user’s effective membership across every profile, including the migration-created profile, and confirm their SMS/voice policy scope. If you need to delay that rollout, evaluate Microsoft’s documented temporary Graph opt-out and verify the resulting profile assignments afterward; do not assume it removes existing credentials. Preserve an alternative authentication method, then test both fresh registration and sign-in with the restricted pilot account.