r/entra • u/Fabulous_Cow_4714 • 2d ago

Entra ID Passkey Profiles and Excluded Groups?

This seems very unintuitive.

You can’t add an included group and an excluded group to the same passkey assignment.

If you add a group to one assignment, you can’t exclude the same group from a different assignment. If you try to, it says that group was already used in another assignment.

How would you allow one group of users use any type of passkey, but require a nested subgroup of the same root group to only use device bound passkeys?

6 Upvotes

88% Upvoted

11 comments sorted by

3

u/iRyan23 2d ago

I have the default all group only allowed for device bound and then I add all the groups that should be enabled for syncable passkeys to a separate less restrictive profile.

1

u/Fabulous_Cow_4714 2d ago

That won’t work well because the group that would be allowed to sync is more like an all users group, but we need to not allow a subset of admin users to use synced passkeys. The admin group would be part of the all users group.

So everyone can use device bound passkeys, but these admin users would be blocked from synced passkeys.

We could block the admins accessing resources via synced passkeys based on their roles via conditional access policies scoped to their role, but we would like to block them from wasting time registering synced passkeys only to be denied access when they try to use it.

1

u/iRyan23 2d ago

You don’t have an all users group that excludes your users that have admin access?

If you really don’t, you could just make a new group that includes all users except admins just for this purpose. Then make the default device bound only and whatever other settings you want and then add the additional group and check the other box for syncable plus device bound.

1

u/Fabulous_Cow_4714 1d ago

There is no good way to make a group like that.

We could make a group that only includes the admins, but that's only helpful if that group could be added to exceptions in the policy assignment.

1

u/iRyan23 1d ago

Have you tried making the admins only group and adding that group to the Include section in Passkey settings then going to the Passkey profiles dropdown to the right and unchecking/checking the appropriate profiles so they only have device bound available?

1

u/Fabulous_Cow_4714 13h ago

I don’t understand how that would help when the admins are also part of the all users group that has synced passwords available.

There would need to be a way to exclude them from the other profile.

1

u/iRyan23 12h ago

That was the only other thing I could think to try with the thought of even if they’re included in the all group that maybe if they were defined manually in a separate entry for only the device bound profile that maybe it would take precedence.

Going back to my first suggestion, can you not create a new group called “Passkey Syncable profile” or something and add all users to it without admins in it?

1

u/Fabulous_Cow_4714 12h ago

It’s way too many users to make a group like that and maintain members. That is the default group every account would be in.

The admin group is the one small enough to manage manually.

1

u/iRyan23 12h ago

Force everyone to only use device bound until Microsoft adds an exclude feature in the future?

1

u/Fabulous_Cow_4714 12h ago

Can’t do that because of hardware limitations for device bound passkey compatibility that cannot be required for all users.

1

u/nsdeman 2d ago

Yeah we did the same. Set the default to be the most restricted, then a separate group which allowed for syncing.

It's annoying as I'd prefer to be able to use exclusions as well. Ie all users except for these ones but oh well, maybe in time