How to disable Passkey within an IP address range

To stop the passkey setup prompt, exclude the onsite users from the Passkey registration campaign; registration campaigns cannot be excluded by IP address or Named Location.

Stop the passkey setup prompt

Sign in as an Authentication Policy Administrator, then:

1. Go to Microsoft Entra admin center → Entra ID → Authentication methods → Registration campaign.
2. Select Edit.
3. Confirm Authentication method is set to Passkey.
4. Under the campaign targets, add an appropriate onsite-users security group to Exclude.
5. Select Save.

Campaign targeting supports users and groups, not network locations. An exclusion takes precedence if a user is both included and excluded.^1^

This exclusion follows the user everywhere—it cannot suppress the prompt only while the user is onsite. If those users should still receive the prompt when offsite, that location-dependent behavior is not supported by the registration campaign.

If onsite users must not register or use passkeys

Change the Passkey (FIDO2) authentication-method targeting, which is also user/group based:

1. Go to Entra ID → Security → Authentication methods → Policies.
2. Select Passkey (FIDO2).
3. Open Enable and Target.
4. Target only the groups that should be permitted to use passkeys, rather than All users.
5. Review any passkey profiles assigned to those groups and save.

Passkey profiles define who may register and authenticate with passkeys and are assigned to groups, not IP ranges.^2^

This is different from suppressing a campaign nudge: removing users from the passkey policy prevents passkey registration/use, whereas excluding them from the campaign only removes the setup prompt.

If the prompt is actually an application sign-in MFA challenge

A Named Location can exclude the office from a Conditional Access MFA policy. Check the affected user’s Entra sign-in log first to identify the policy that applied; do not change the passkey campaign if Conditional Access generated the challenge.

For the applicable MFA policy, sign in as a Conditional Access Administrator and configure:

1. Entra ID → Conditional Access → Policies.
2. Open the policy requiring MFA or an authentication strength.
3. Under Assignments → Network:
   • Set Configure to Yes.
   • Include: Any network or location.
   • Exclude: the office Named Location, or All trusted networks and locations if that is intentionally broader.
4. Set the policy to Report-only and test onsite and offsite sign-ins.
5. After validating the result, change it to On.

Microsoft documents this pattern for excluding trusted corporate networks from an MFA Conditional Access policy.^3^ “Any network or location” includes every IP address, while the exclusion narrows the policy to locations outside the selected trusted network.^4^

Conditional Access requires an appropriate Microsoft Entra ID Premium license; passkey availability itself does not require an additional license.^2^

If MFA appears specifically during passkey registration

Conditional Access can separately target:

Target resources → User actions → Register security information

Such a policy can include Any location and exclude the trusted office location.^5^

However, that exclusion removes only the Conditional Access policy’s additional grant requirement. It does not:

• suppress the passkey registration-campaign prompt; or
• bypass the built-in requirement that users complete MFA within the previous five minutes before registering a passkey.^2^

Therefore, use the campaign’s user/group exclusion to stop the setup prompt.

Excluding an office network from MFA reduces protection for every scoped sign-in originating through that public egress address. Keep the exclusion narrow, verify the organization’s fixed public egress ranges, and prefer phishing-resistant MFA or device-based controls where practical rather than treating network location alone as sufficient trust.

References

1. Run a registration campaign to set up a passkey or Microsoft Authenticator
2. How to enable passkeys (FIDO2) in Microsoft Entra ID
3. Require multifactor authentication for all users
4. Conditional Access: Network assignment
5. Protect security info registration with Conditional Access policy