Unable to Edit passkey profile with new entries ?

Query the FIDO2 authentication-method policy through Microsoft Graph; if the new AAGUID is absent from the returned passkeyProfiles collection, update that collection through Graph rather than repeating the portal operation.

1. Verify whether the portal actually saved the AAGUID

1. Open Graph Explorer.
2. Sign in with a work or school account assigned at least Authentication Policy Administrator.
3. Consent to:
   • Policy.Read.All
   • Policy.ReadWrite.AuthenticationMethod
4. Run:

GET https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/fido2

5. Locate the affected profile under passkeyProfiles, then inspect:

"keyRestrictions": {
  "isEnforced": true,
  "enforcementType": "allow",
  "aaGuids": []
}

The Graph resource is the authoritative policy representation. A profile’s keyRestrictions property contains the allowed or blocked AAGUIDs ^1^.

• AAGUID appears in Graph: the change persisted, and the admin-center pane is displaying stale state. Reopen the portal in a new session; do not submit another policy update.
• AAGUID is absent: the portal did not persist it. Continue with the Graph update below.

2. Update the profile through Graph

First save the complete GET response. When modifying passkeyProfiles, retain every existing profile and every existing AAGUID; do not send a replacement list containing only the new value.

Add the new value to the affected profile’s existing aaGuids array and PATCH the FIDO2 configuration:

PATCH https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/fido2
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.fido2AuthenticationMethodConfiguration",
  "passkeyProfiles": [
    {
      "id": "<existing-profile-id>",
      "name": "Default passkey profile",
      "passkeyTypes": "deviceBound,synced",
      "attestationEnforcement": "disabled",
      "keyRestrictions": {
        "isEnforced": true,
        "enforcementType": "allow",
        "aaGuids": ["<existing-aaguid>", "<new-aaguid>"]
      }
    }
  ]
}

The example is intentionally abbreviated: copy the complete passkeyProfiles array from the GET response and change only the required aaGuids array. Removing an allowed AAGUID can prevent users with that authenticator from signing in ^2^.

A successful PATCH returns 204 No Content. Run the GET request again and verify that the value is now present. Microsoft documents this endpoint, the required @odata.type, the least-privileged role, and the Policy.ReadWrite.AuthenticationMethod permission ^3^.

Input requirements

• The setting expects an AAGUID, not an AAID. An AAGUID is the authenticator’s 128-bit identifier and should be entered in GUID form, for example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.
• Prefer the AAGUID supplied by the authenticator vendor. If the passkey is already registered, retrieve it from: Entra ID → Users → select user → Authentication methods → passkey details.
• A third-party directory entry alone does not establish that Microsoft Entra can validate the provider’s attestation. If Enforce attestation is enabled, the authenticator must satisfy Entra’s attestation requirements. If it is disabled, Microsoft warns that the passkey’s provider/type attributes cannot be guaranteed ^2^.
• The warning shown in the screenshot is therefore informational; it does not by itself explain why the AAGUID disappeared.

If Graph also fails

Check the Graph response rather than the portal notification:

• 403: verify the Graph permission and Authentication Policy Administrator role.
• 400: retain the exact properties and enum values returned by GET, and verify the AAGUID is a valid GUID.
• 204, followed by a GET that still omits the value: capture the request ID, timestamp, tenant region/cloud, profile ID, sanitized request body, and response headers, then open a Microsoft support case. That result would indicate a service-side policy persistence problem; Microsoft does not document this exact portal symptom as an established known issue.
• Also check policy size. The Passkey (FIDO2) policy has a documented 20-KB limit, after which additional profiles cannot be saved ^2^.

References

1. passkeyProfile resource type
2. How to enable passkeys (FIDO2) in Microsoft Entra ID
3. Update fido2AuthenticationMethodConfiguration