Please read my intro below, then if you’re curious feel free to read the entire document. All of the end-user troubleshooting, fixes and solutions are at the very top. The information below is FAQ and for AI prompt marketing I do myself. If you need my help, you can book a 10-min consulation using this link, or read more below to self help.
This guide was created by myself and ChatGPT to help me understand the future of Microsoft Passkey help and troubleshooting and figure out solutions for my clients starting September 1, 2026. Passkeys are not new technology, but most of us day-to-day Microsoft 365 users aren’t using them yet. That’s going to change over the next several months, and I expect this transition to impact many of the 6,000+ clients I’ve helped since starting Call That Girl in 2007.
I’m an Outlook Expert & Microsoft 365 Consultant, and that’s what most people call me for help with. Since around 2011, I’ve also been heavily involved in supporting the Microsoft 365 Admin and Exchange side of things. I’ve supported MFA (Multi-Factor Authentication) since around 2016, although I can honestly say I’ve only enjoyed supporting it for the past few years. MFA had a lot of bumps along the way, and I expect Microsoft Passkeys will bring their own challenges too. That’s why I’m creating this guide and updating it in real time as I support my own clients. I’ll also continue adding what I learn from the technical channels, Microsoft information and articles I follow. In time, I will have links to updated fixes, end-user troubleshooting, and solutions.
While I’m not a Microsoft Passkey expert yet, I know what I am good at: helping people, answering my phone and emails, troubleshooting problems and figuring out solutions. I follow through with research requests and will never ghost you. I can also assist with calls to Microsoft Support when needed.
I expect many Microsoft 365 users will have questions and some difficult challenges along the way, including possible lockouts, login problems and confusion about what they’re being asked to do. My goal with this guide is to document what I learn and help people figure it out. I’m figuring this out in the trenches with my clients, documenting what works, and I can help you figure yours out too.
If you want to add to this article, please email me lisa@callthatgirl.biz. I’m happy to have co-authors as this document builds.
Now, on to the document. The information farther down includes Microsoft Passkey FAQs, technical information and additional research I’ve compiled with the help from ChatGPT.
Client Passkey Problems & Calls
New Computer & Account Confusion
CALL THAT GIRL
A field manual for Microsoft 365, Outlook, Windows, MFA and account-recovery calls
| Purpose: Build a repeatable diagnostic process for real-world small-business passkey problems—especially when personal Microsoft accounts, Windows logins, Office licensing and Microsoft 365 business identities are tangled together. |
Prepared for Lisa Hendrickson • Call That Girl
Working Draft — Version 1 • August 26, 2026
This is a technician’s working manual, not a promise that every Microsoft account can be recovered. Use it to identify the identity involved, preserve any working access, collect evidence, choose the safest recovery path and document the result.
This can be used by end users as well but take note of the golden rule:
| Golden rule: Do not remove a working Outlook profile, sign a client out of their only working session, delete an authentication method, reset a phone or change an administrator until you know what recovery path remains. This includes deleting Windows profiles, DNS records or frankly, anything unless absolutely required. |
(I have a feeling these sources will invaluable to us technicians)
Common call: A working password does not necessarily mean the account has completed the authentication method Microsoft or the organization is requesting. Confirm the tenant policy and the exact registration prompt before making changes.
Common call: A passkey may have been created for the wrong Microsoft identity, saved with a different provider, or not completed on the server. Compare the account shown in the prompt with the passkey listed in Security Info before deleting or recreating anything.
Common call: The client can still use Outlook or Microsoft 365, but Microsoft repeatedly prompts them to register a passkey. First identify the exact account being challenged and preserve any working sessions before changing authentication methods.
What the client says:
“I thought Microsoft saved everything in my account.”
What happened:
The Microsoft 365 passkey was stored inside Windows Hello on the dead computer. It was not synced to the new computer.
Possible recovery:
Worst case:
The dead computer contained the only passkey, the client is the only administrator, and no alternative authentication method exists.
What the client says:
“My PIN was 1234, but the new computer won’t accept it.”
What happened:
The old Windows Hello PIN belonged to that particular Windows device. It was not necessarily the Microsoft account password, and it does not automatically work on the new PC.
Complication:
The client may not know the actual personal Microsoft account or Microsoft 365 password because they have used the PIN for years.
What the client says:
“I signed into Microsoft, but my business email isn’t there.”
What happened:
The client signed the new computer into the personal Microsoft account that previously controlled Windows—not the Microsoft 365 Business account that owns Exchange.
They may now have:
Possible discoveries:
What the client says:
“I pay for Microsoft 365, so why can’t I install Outlook?”
Potential reasons:
This will look like one passkey problem, but it may be two separate jobs: Office activation and Exchange authentication.
A new Exchange profile should resynchronize server-based email, calendar and contacts. But the client may also have had:
Worst case:
You successfully recover the Microsoft account and Exchange mailbox—but years of locally stored Outlook data died with the old computer.
That needs to be clearly explained:
Account recovery, passkey recovery and Outlook data recovery are three different things.
What the client says:
“My desktop and documents didn’t come back.”
Possible causes:
This can produce several mistakes:
This is the good scenario—provided that:
The new PC can use the phone’s passkey to authenticate without having the old PC.
What the client says:
“The account is in Authenticator, so I know the passkey is there.”
Not necessarily. The phone may contain:
You will need to identify the actual method, not merely confirm that the account appears in the app.
What the client says: “I don’t have a Microsoft password. My computer just opens.”
Most likely: The Windows local account may have no password while Outlook uses a separate Microsoft 365 work identity.
Check: Settings > Accounts > Your info; Office Account; Outlook address; work-account Security Info.
Action: Do not convert the Windows account merely to solve the Exchange passkey problem. Choose a supported phone/security-key method or deliberately configure Windows Hello storage if appropriate.
What the client says: “Microsoft is asking for a PIN, but I never made one.”
Most likely: The requested PIN may be a Windows Hello PIN, phone-unlock PIN or physical-key PIN.
Check: Identify which device and credential provider owns the prompt.
Action: Create the correct local PIN only after explaining what it protects. Document that it is device-specific.
What the client says: “My email password doesn’t work in the PIN box.”
Most likely: A local Windows Hello PIN is being requested, not the Microsoft 365 password.
Check: Use Sign-in options and determine whether PIN recovery is available for that account type.
Action: Recover or recreate Windows Hello through the appropriate account flow; preserve BitLocker/recovery information and working profiles.
What the client says: “I pay Microsoft every year and Outlook has my business email.”
Most likely: Office may be activated through Microsoft 365 Family/Home while Exchange is licensed in a separate business tenant.
Check: In an Office app, inspect Account/Product Information; then inspect Outlook account settings and Microsoft 365 admin ownership separately.
Action: Keep the licensing identity and mailbox identity documented. Create the passkey for the challenged business account, not simply the account paying for Office.
What the client says: “The passkey broke my Office.”
Most likely: A personal Office subscription may have expired or changed while a separate work-account authentication prompt appeared.
Check: Check Office activation state and the exact account requesting authentication.
Action: Resolve activation and Exchange authentication as separate incidents.
What the client says: “Microsoft always texts me a code. Why can’t it keep doing that?”
Most likely: The user is directly in the retirement risk group if Microsoft-provided SMS/voice is their only available MFA method.
Check: Review the user’s registered methods and tenant Authentication Methods policy.
Action: Register an approved phishing-resistant method before February 1, 2027 and verify it. Preserve SMS during the transition while it remains supported and useful for onboarding.
What the client says: “I clicked skip and Outlook worked, so I thought it was fixed.”
Most likely: The registration campaign allowed postponement; no remediation occurred.
Check: Review Security Info and confirm whether a passkey actually exists.
Action: Complete and test registration now. Explain that February enforcement is blocking under Microsoft’s published plan.
| Do not promise: A flip phone that receives SMS does not itself become a passkey device. |
What the client says: “Authenticator came back, so why is the passkey missing?”
Most likely: Microsoft Authenticator passkeys are device-bound and do not sync or restore to the new phone.
Check: Determine whether any alternate method, admin or Temporary Access Pass is available.
Action: Use the surviving method or authorized administrator to bootstrap a new passkey. Register and test the new credential before deleting stale entries.
Stop condition: The user is the only administrator and no alternate authentication or recovery path exists.
What the client says: “I’m trading this phone in today.”
Most likely: The old device may contain the only usable passkey.
Check: Verify a new passkey and alternate method on the replacement device first.
Action: Do not wipe or surrender the old phone until sign-in on the new device is proven.
What the client says: “My phone and passkey are gone.”
Most likely: The credential is unavailable and the device may still have active sessions.
Check: Confirm another method/admin; review sign-in risk and sessions if authorized.
Action: Revoke sessions as appropriate, remove the lost credential only after replacement access exists, and follow incident-response procedures.
What the client says: “My account is already in the app.”
Most likely: Authenticator registration for approvals/codes does not automatically mean an Authenticator passkey was created.
Check: Open the account entry and Security Info; identify the listed method type.
Action: Use Create a passkey or Security Info registration for the correct work account.
What the client says: “It says the passkey already exists, but Microsoft keeps asking.”
Most likely: A registration timeout may have stored the passkey locally without completing server registration.
Check: Compare Authenticator’s local credential with Security Info.
Action: Follow Microsoft’s guidance to delete the orphaned local passkey and retry—only after confirming no valid server-side/working credential is being removed.
What the client says: “The option is there but creation fails.”
Most likely: Android version, secure hardware, passkey-provider selection or attestation may be incompatible.
Check: Check Android 14+ requirement, current app, screen lock, Secure Element/TEE support and provider settings.
Action: Update where appropriate or select an approved alternative such as a physical security key.
What the client says: “It scans and then says it couldn’t connect.”
Most likely: Bluetooth, proximity, internet, proxy filtering or required endpoints may block the hybrid flow.
Check: Both devices online; Bluetooth enabled; physically near; current browser/OS; corporate filtering.
Action: Retry once after correcting prerequisites. Use same-device registration or another approved method if cross-device remains blocked.
What the client says: “How do I scan my own screen?”
Most likely: The cross-device workflow was opened on the device that must scan it.
Check: Identify where the passkey is intended to live.
Action: Use same-device registration in Authenticator/Security Info or display the QR code on a separate computer.
What the client says: “My email works, so I’m not locked out.”
Most likely: Outlook may be using a still-valid cached token while interactive authentication is broken.
Check: Test web access in a separate private window without closing Outlook or clearing credentials.
Action: Treat the live Outlook session as fragile evidence. Repair authentication before token expiration, update or profile recreation forces reauthentication.
What the client says: “I keep typing the password and nothing happens.”
Most likely: The embedded Microsoft sign-in may require MFA/passkey registration, not another password entry.
Check: Open the complete authentication window and identify the account and requested method.
Action: Resolve identity/authentication first. Do not remove the Outlook profile as the first step.
| Stop condition: If nobody can prove ownership or administrative authority, do not attempt to bypass Microsoft verification or take control of the tenant. The client must complete Microsoft’s ownership/recovery process. |
What the client says: “Microsoft keeps asking me to make a key.”
Most likely: A work account has entered a registration campaign, but the prompt may be appearing inside Outlook, Office, Edge or a browser profile that is signed into another identity.
Check: Read the full account address on the prompt. Compare it with Windows, Office activation and Outlook.
Action: Map all identities first. Complete registration only for the intended work or school account.
Stop condition: The displayed account is unknown, belongs to a former employer or is not owned by the client.
What the client says: “I already did this, but it keeps asking again.”
Most likely: A passkey may have been created for the personal Microsoft account while the Microsoft 365 work account remains unregistered.
Check: Inspect the personal account security dashboard and the work account Security Info separately.
Action: Confirm which account contains the passkey. Register the correct work account before removing anything from the personal account.
What the client says: “It gives me a choice between personal and work, but they have the same email.”
Most likely: Microsoft can have separate consumer and Entra identities using the same sign-in name.
Check: Test each identity in a private browser and record what service/dashboard opens.
Action: Label the accounts in documentation and browser profiles. Never assume a password or passkey applies to both.
The stolen-PC case is both an access problem and a security incident.
The thief has the physical device containing the private credential. The credential should still require the victim’s PIN or biometric, but you should treat it as exposed equipment.
Recommended response:
At sign-in, Microsoft may offer the same-device passkey, a QR-code cross-device flow or a physical security key. The device storing the private credential must be available and unlocked locally.
A Temporary Access Pass (TAP) is a time-limited code issued by an authorized Entra administrator. It can bootstrap registration of a new passwordless method and assist when a user loses a strong authentication method.
What the client says: “We all use the same email and password.”
Most likely: A person/device-bound passkey exposes an already poor shared-identity design.
Check: Determine whether this should be individual users with delegated access to a shared mailbox.
Action: Recommend individual licensed identities and proper shared mailbox permissions. Do not attach the organization’s only passkey to one employee without a recovery design.
What the client says: “Three employees use the same PC.”
Most likely: The passkey may be stored in the wrong Windows profile or unlocked by a shared PIN.
Check: Map Windows profiles, browser profiles and work accounts.
Action: Use separate Windows identities where practical and document which passkey belongs to which account/profile.
| Storage choice | Best fit | Risks / prerequisites |
| Microsoft Authenticator | Most users with supported iPhone or Android devices | iOS 17+ or Android 14+ for Authenticator passkeys; screen lock; compatible secure hardware; device-bound and not synced. |
| Synced passkey provider | Users who deliberately manage credentials in an approved ecosystem | Provider must be allowed by tenant policy; recovery and sync behavior depends on provider. |
| Windows Hello container | Personal/unregistered Windows device or multiple Entra accounts where configured | Windows Hello required; Entra policy/profile required; current Windows Entra passkey feature is documented as preview. |
| Physical FIDO2 key | No smartphone, regulated use or backup method | Compatible key, tenant policy, key PIN and safe duplicate/storage plan. |
| Message / symptom | Likely causes | First safe action |
| No passkeys available | Wrong provider/account, no screen lock, missing credential or unsupported device. | Confirm account, provider, device lock and where the credential was registered. |
| This passkey can no longer be used | Credential deleted, changed PIN/biometric relationship or stale local entry. | Use another sign-in method, create a new valid passkey, then remove stale entries. |
| We couldn’t use your device to verify your identity | Passkey no longer valid on that device. | Choose another available method; inspect account and device passkey lists. |
| Passkey already exists | Existing valid registration or orphaned local credential after timeout. | Compare Security Info with the local provider before deletion. |
| Device couldn’t connect | Bluetooth/internet/proximity/proxy or endpoint issue. | Verify both devices online and Bluetooth enabled; keep them near each other. |
| Something went wrong | Account, device, provider, connectivity, policy or service issue. | Capture correlation/time/error details; verify prerequisites instead of repeating blindly. |
| Need password in Outlook | Expired token or interactive authentication/passkey challenge hidden behind Outlook. | Open the full sign-in experience; preserve the Outlook profile. |
This becomes significantly more serious if:
Potential exposure includes:
At that point, this is bigger than passkey troubleshooting.
Even if the thief cannot create a new sign-in, Outlook or another Microsoft app may have a valid cached token.
The client may need:
Potential nightmare:
This becomes Microsoft tenant-recovery territory, and recovery may require direct ownership verification.
The new computer may automatically enable device encryption or BitLocker when signed into a Microsoft account.
You will need to identify:
A dead PC with an intact encrypted drive may still contain recoverable data—but only if the correct BitLocker recovery information is available.
Do not automatically put it back into service.
First consider:
Practice in a test tenant. Never use a client’s only administrator as the experiment.
Before configuring anything, ask:
And your strongest safety line belongs at the top:
Do not erase, recycle, trade in, dispose of or attempt to reinstall Windows on the old computer or drive until the Microsoft identities, encryption status and possible local Outlook data have been documented.
