Synced iCloud Keychain passkey registration succeeds despite Device-Bound-only passkey profile

To answer your follow-up questions directly:

Why it happened: Microsoft documents that when a user is in scope of several passkey profiles, they are evaluated with no priority. Registration succeeds if the credential satisfies any one of them. Since September 1, 2026, users enabled for SMS/voice (in the Authentication Methods Policy or in legacy MFA settings) are auto-enabled into a profile that allows all passkey types. Your pilot user is SMS-enabled, so the system profile adds to your device-bound profile rather than overriding it. Your AAGUID restriction wasn't ignored; it was just never the only path.

The opt-out applies to the whole tenant and needs Policy.ReadWrite.AuthenticationMethod:

PATCH https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy

{ "optOutSettings": { "passkeyDynamicMigration": true }}

Check it with a GET on the same URI (optOutSettings). It delays auto-enablement and the Microsoft-managed registration campaign until February 1, 2027. After that, enforcement applies and there's no opt-out.

Caveat: Microsoft doesn't document that the opt-out deletes passkeys that are already registered. I also couldn't find a clear statement on whether it reverses auto-enablement already applied to your tenant. Test with one account first.

Ways to make your profile the only effective one now:

- Remove the pilot users from SMS/voice scope in the Authentication Methods Policy. Microsoft's own guidance says moving users out of SMS/voice keeps them out of auto-enablement. Keep a fallback method, such as a Temporary Access Pass (TAP).

- Delete the synced passkey from the user's authentication methods, then have them register again.

- Enforce it at sign-in as well: create a custom authentication strength that allows only the Authenticator AAGUIDs and require it in Conditional Access for the pilot group. This doesn't block registration, but a synced passkey can't satisfy the policy.

- With AAGUID targeting, a Microsoft-managed registration campaign won't switch to passkeys, so set the campaign to Enabled and target it manually.

Docs: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement and https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2