difficulties signing into my university Microsoft account with my laptop

Contact your university IT help desk and ask them to inspect the enforced authentication strength and your registered passkeys; resetting only your password or Authenticator MFA may not resolve a sign-in that completes MFA and then separately requires a passkey.

What to send university IT

Use this wording:

My password and Microsoft Authenticator approval both succeed, but Windows Security then requires a passkey. Cross-device passkey authentication returns “device not close enough” or loops back to the passkey page. Please review my Entra sign-in logs to identify the enforced authentication strength, check my registered passkeys for a stale/orphaned credential, and confirm whether Conditional Access requires a passkey. If necessary, remove the unusable passkey and provide a policy-compliant way to register a new one.

Your university controls this work-or-school account’s authentication methods and Conditional Access policies.

Actions for the university administrator

1. Identify what is requiring the passkey
   • Open the affected event in Microsoft Entra admin center → Entra ID → Monitoring & health → Sign-in logs.
   • Under Authentication Details, inspect Requirement.
   • Under Conditional Access, open the applied policy and inspect Grant Controls to see which authentication strength was enforced. ^1^
2. Inspect your authentication methods
   • Go to Entra ID → Users → your account → Authentication methods.
   • Check whether a passkey remains registered but is no longer usable. An orphaned passkey can exist locally while no longer matching the Entra registration; Microsoft’s documented remedy is to remove that credential and register a new passkey. ^2^
3. If ordinary MFA registration is also inconsistent
   • Select Require re-register MFA under your Authentication methods page.
   • This removes registered Authenticator, phone, and software OATH methods and prompts you to configure MFA again at the next sign-in. It does not replace the need to review a separately enforced passkey requirement. ^3^
4. If passkey registration itself loops
   • Review Conditional Access policies scoped to All resources. Microsoft documents a registration loop when such a policy requires phishing-resistant authentication.
   • The administrator may need to exclude Microsoft Authenticator Credential Registration from the relevant policy while still enforcing any policy targeting Register security info. ^4^ ^5^

About the QR-code flow

The QR code on the Windows Security page is for using a passkey that is already stored on the phone; approving an Authenticator MFA notification does not by itself create that passkey. Cross-device passkey authentication also requires:

• Bluetooth enabled on both the laptop and phone.
• Both devices connected to the internet.
• The devices within Bluetooth range.
• University policy permitting Bluetooth-based cross-device authentication. ^6^

Since the password, QR scan, and Authenticator approval routes have already returned to the same passkey screen, repeating them will not address a missing/stale passkey or a policy that requires a different authentication strength.

References

1. Troubleshoot Conditional Access authentication strengths
2. Sign in with a synced passkey (FIDO2)
3. Manage user authentication methods for Microsoft Entra multifactor authentication
4. Troubleshoot common issues with Microsoft Entra B2B collaboration
5. Enable passkeys in Authenticator
6. Troubleshoot signing in with a passkey | Microsoft Support