Microsoft Entra ID Removes Extra MFA Step for Windows Hello and macOS PSSO Users
What Happened — Microsoft announced that, beginning October 2026, Entra ID will treat Windows Hello for Business (WHfB) and macOS Platform Single Sign‑On (PSSO) as sufficient MFA credentials, eliminating the need for an additional passkey or authenticator during primary sign‑in. The change applies to all worldwide and GCC tenants and requires no admin configuration.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (Logical Access) expects documented, multi‑factor authentication controls; a shift in MFA handling must be reflected in your access‑control policies and evidence collection.
- Continuous‑compliance programs need to capture the new device‑bound MFA state as audit evidence, and verify that step‑up MFA policies (e.g., Authentication Strength) still enforce stronger checks where required.
- The device‑bound nature of WHfB/PSSO introduces a potential “single‑device” gap; auditors will look for documented mitigation (portable MFA methods) and proof that users can satisfy MFA from alternate devices.
Who Is Affected — Enterprises using Microsoft Entra ID, particularly those with BYOD or remote‑work models, across technology, finance, healthcare, and government sectors.
Recommended Actions
- Review and update your SOC 2 access‑control policies to include WHfB and macOS PSSO as MFA‑eligible credentials.
- Ensure Authentication Strength and step‑up MFA policies are still enforced for high‑risk actions.
- Require users to register a portable MFA method (e.g., synced passkey or Microsoft Authenticator) and capture the registration as evidence in your compliance repository.
- Update your continuous‑monitoring dashboards to log device‑bound MFA usage and any MFA failures from secondary devices.
Source: Help Net Security
Technical Notes — No new CVEs; the change is a configuration update (MC1450134) that treats device‑bound credentials as MFA‑capable. The only operational caveat is that users may be unable to complete MFA from a device that does not hold the credential, prompting a need for secondary, portable MFA factors. Source: same article