Microsoft Entra ID
GeneralOptional Claims Reference
In brief
The reference now explicitly labels synced passkeys as PRMFA and specifies that the PRMFA certificate-based authentication entry applies to multi-factor CBA.
What Entra admins need to know
Administrators can use the clearer labels to distinguish authentication methods when interpreting optional claims.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Email | emailotp, mfa |
| FIDO2 security key (PRMFA) | fido, mfa |
| Passkey (device-bound) (PRMFA) | fido, mfa |
| Passkey (synced) (PRMFA) | fido, mfa |
| Windows Hello for Business (PRMFA) | hwk, mfa, ngcmfa |
| Certificate-based authentication (PRMFA)(PRMFA for Multi-factor CBA) | hwk (Multi-factor CBA) or x509 (Single factor CBA), mfa, rsa |
| Temporary Access Pass (TAP) | otp, mfa |
| Windows integrated authentication (Kerberos) | wia |
| Device based X509 authentication | x509 |
@@ -140,9 +140,9 @@ For OIDC, see the following table, which lists the `authnmethodsreferences` valu | Email | `emailotp`, `mfa` | | FIDO2 security key (PRMFA) | `fido`, `mfa` | | Passkey (device-bound) (PRMFA) | `fido`, `mfa` |-| Passkey (synced) | `fido`, `mfa` |+| Passkey (synced) (PRMFA) | `fido`, `mfa` | | Windows Hello for Business (PRMFA) | `hwk`, `mfa`, `ngcmfa` |-| Certificate-based authentication (PRMFA) | `hwk` (Multi-factor CBA) or `x509` (Single factor CBA), `mfa`, `rsa` |+| Certificate-based authentication (PRMFA for Multi-factor CBA) | `hwk` (Multi-factor CBA) or `x509` (Single factor CBA), `mfa`, `rsa` | | Temporary Access Pass (TAP) | `otp`, `mfa` | | Windows integrated authentication (Kerberos) | `wia` | | Device based X509 authentication | `x509` |