For: Institution administrators, account managers, and support staff at institutions that use Microsoft (Microsoft Entra ID / work or school accounts) for sign-in
Status: In progress
Last updated: October 16, 2026
Summary
On September 1, 2026, Microsoft began making passkeys the default way to sign in to work and school accounts. A passkey lets you sign in with a fingerprint, face, PIN, or phone instead of a password and code.
Guardian Browser doesn't fully support passkey sign-in yet, so some test takers can't finish signing in when Microsoft asks for a passkey. We're building passkey support now. Until it's released, the options below let test takers sign in and take their exams.
Why this is happening now
Microsoft is moving accounts to phishing-resistant sign-in methods and retiring Microsoft-provided SMS and voice authentication. As part of that change, test takers who used SMS or a phone call for multifactor authentication were automatically enabled for passkeys. After signing in, they're now prompted to set one up.
Key dates from Microsoft:
Date | What changes |
|---|---|
September 1, 2026 | Passkeys become the default. Users enabled for SMS or voice are prompted to register a passkey after sign-in. The prompt can be skipped. |
February 1, 2027 | Microsoft-provided SMS and voice authentication is retired. Users whose only other method is SMS or voice must register a passkey before they can sign in. This prompt can't be skipped. |
Test takers who also have another method, such as the Microsoft Authenticator app, can keep using it after February 1. For full details, see Microsoft's article: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication (Message Center post MC1426371).
Who is affected
Test takers are affected if all of these are true:
- They sign in through Microsoft while in Guardian Browser. This includes signing in to your LMS (for example, Canvas) through Microsoft single sign-on.
- They have a passkey on their Microsoft account, or Microsoft is prompting them to create one.
- They're taking the exam in Guardian Browser, not the Guardian extension.
What test takers may see
Device | What happens |
|---|---|
Windows | Passkey sign-in may work, but test takers may see extra security prompts they need to click through or cancel. Sometimes the passkey option doesn't appear at all. |
Mac | Passkey sign-in doesn't work in Guardian Browser yet. |
Options available now
Option 1: Use the Guardian extension
Passkey sign-in works normally in the Guardian extension because the extension runs in the test taker's regular browser.
Institutions: Contact your account manager. They can confirm whether the Guardian extension is allowed as a fallback for your exams, or set the Guardian extension as your primary workflow until passkey support is released in Guardian Browser.
Test takers: If the extension is allowed as a fallback for your institution, Meazure Learning Support can switch your exam to the extension when you contact them.
Option 2: Use a sign-in method other than a passkey
Test takers can skip the passkey prompt or choose another sign-in method, if your institution's Microsoft setup allows it.
Microsoft administrators can make sure test takers have a non-passkey method available, such as the Microsoft Authenticator app. A few things to know:
- Temporary opt-out: Microsoft offers a temporary opt-out that delays automatic passkey enablement and the passkey registration prompt. It's set through Microsoft Graph, not the admin center, and it's available only until February 1, 2027. See Microsoft's article above for the steps.
- Keeping SMS or voice: Starting October 30, 2026, institutions that need SMS or voice after February 1, 2027 can set up a telephony provider through Microsoft Security Store.
- Removing passkeys from individual accounts also works, but it isn't a long-term fix because Microsoft will keep prompting those test takers to set one up.
Instructions to share with test takers
You can copy the following and send it to your test takers.
Having trouble signing in with Microsoft in Guardian Browser?
- If Microsoft asks you to set up or use a passkey, select Skip or Cancel, then select Other ways to sign in or Sign-in options.
- Choose a method that isn't a passkey (passkeys are often labeled Face, fingerprint, PIN or security key), such as the Microsoft Authenticator app. Finish signing in and continue to your exam.
- If you still can't sign in, contact Meazure Learning Support. If your institution allows it, Support can switch your exam to a different workflow so you can sign in.
If Support can't switch your exam, contact your institution's IT help desk and ask them to make sure you have a sign-in method other than a passkey.
When contacting Support, please include your device type (Windows or Mac) and a screenshot of the sign-in screen, if you can.
What we're doing
We're building passkey support for Guardian Browser on both Windows and Mac, and we'll release it for both at the same time.
The Mac work requires Apple's approval for a capability that lets Guardian Browser use Mac passkeys, which are stored in iCloud Keychain. We've submitted the request, and the timeline depends on Apple's review. We'll update this article as things progress.
How you can help
A test account on your institution's Microsoft sign-in setup helps us test against your exact configuration. The most useful account is one with a passkey registered and the same sign-in policy your test takers use. If you can provide one, contact your account manager.
FAQ
Did a Guardian Browser update break passkey sign-in? No. Passkey support is new functionality that Guardian Browser hasn't offered before. Test takers are running into this now because Microsoft made passkeys the default on September 1, 2026.
Does this affect personal Microsoft accounts (Outlook.com, Hotmail)? This article is about Microsoft work and school accounts, which is how institutions sign in. If a test taker sees a passkey prompt on a personal account, the same sign-in steps in Option 2 apply.
Will test takers be blocked after February 1, 2027? Only test takers whose sole multifactor method is SMS or voice, and only if their institution hasn't set up a telephony provider. Those test takers will have to register a passkey. Making sure test takers have another method, such as Microsoft Authenticator, or using the Guardian extension avoids this.
Who do I contact with questions? Contact your account manager or Meazure Learning Support. We're glad to go over these options with your team.