Windows 365 Brings External Identities and Passwordless Auth to Android — What IT Admins Need to Know

For IT administrators managing Windows 365 environments, supporting external users on mobile devices has historically meant compromise. You could give contractors access to Cloud PCs, but the identity experience on Android lagged behind Windows and macOS. Password-based authentication remained the norm for in-session challenges, even as Microsoft pushed passkeys and passwordless sign-in across the rest of its ecosystem.

That gap narrowed significantly this week. Microsoft’s latest Windows 365 update, announced for the week of July 27, 2026, delivers two Android-focused capabilities that together reshape the mobile access story for Cloud PCs:

1. External identity support is now generally available for Windows App on Android
2. In-session passwordless authentication is in preview for Windows App on Android

Let’s break down what each feature does, why it matters, and how to prepare your environment.

1. External Identity Support on Android (GA)

The Problem It Solves

External identities — contractors, partners, suppliers, and other non-employee users managed through Microsoft Entra External ID — have been able to access Windows 365 Cloud PCs for some time. However, client support has been uneven. External identity access was available on Windows and web clients, and gradually expanded to macOS and iOS. Android remained the holdout, which meant organizations with contractors using Android tablets or phones had to either issue company-managed Windows devices or limit access to less convenient platforms.

That changes with this GA announcement. External identities can now sign in to Windows App on Android and access their assigned Cloud PCs using their external identity — no internal AD account required.

How It Works

The underlying mechanics rely on Microsoft Entra External ID and, where configured, domainless SAML IdP federation. With domainless federation now generally available (announced in June 2026), you can provision Cloud PCs for external identities whose email domain differs from the domain configured on the SAML IdP. The user redeems their invitation to the organization, then signs in to Windows App on Android with their external credentials.

For organizations using Global Secure Access (Private Access), external users can connect from their own Android devices through the Global Secure Access client, reaching private resources behind Cloud PCs with traffic forwarding profiles you assign. This creates an end-to-end Zero Trust model: external identity → Conditional Access → Global Secure Access → Windows 365 Cloud PC.

Why It Matters

Client parity. Android is the missing piece. External users can now use the same identity model across Windows, macOS, iOS, and Android, giving IT admins consistent policy enforcement regardless of device.

Simplified onboarding. No need to provision internal AD accounts for contractors. External identities stay in Entra External ID, cleanly separated from your workforce directory, with targeted Conditional Access and lifecycle management.

Expanded deployment scenarios. Field workers, contractors on shared Android tablets, and partners using personal devices can all access Cloud PCs without the friction of platform limitations.

What IT Admins Should Do

• Review your external identity policies. If you’ve been holding back on Android support, now is the time to update your access policies to include Windows App on Android as an approved client.
• Verify Conditional Access. Ensure your CA policies target the Windows 365 cloud app and apply authentication strength requirements appropriate for external users.
• Test the experience. Have a pilot group of external users install Windows App on Android from the Google Play Store and validate the sign-in and connection flow.
• Update documentation. Revise your onboarding guides for contractors to include Android as a supported platform.

2. In-Session Passwordless Authentication on Android (Preview)

The Problem It Solves

Even with strong sign-in at the front door, Cloud PC sessions often require additional authentication challenges — re-authentication for sensitive actions, Conditional Access step-up prompts, or app-level sign-ins within the session. Historically, these in-session challenges on Android defaulted to passwords or legacy MFA methods like SMS or voice calls.

This is problematic for two reasons. First, passwords are phishable and historically the weakest link in the security chain. Second, Microsoft is actively retiring legacy MFA: native SMS and voice MFA in Entra ID will be retired on February 1, 2027, and starting September 1, 2026, users still relying on those methods will be prompted to register passkeys.

The new preview feature brings WebAuthn-based passwordless authentication to in-session challenges on Windows App for Android, using passkeys stored in Microsoft Authenticator.

How It Works

The flow is straightforward once configured:

1. Admin enables passkeys. An Authentication Policy Administrator enables Passkey (FIDO2) with the Synced profile type in the Entra admin center, targeting it to relevant users or groups.
2. User registers a passkey. The user adds their work or school account to Microsoft Authenticator on Android and creates a passkey, either directly in the app or through the Security info page.
3. In-session challenge triggers WebAuthn. When Windows App on Android or a resource inside the Cloud PC requests strong authentication, the app triggers a WebAuthn challenge. Android hands off to Authenticator, which uses the locally stored, hardware-protected passkey to complete the challenge — typically with biometric verification (fingerprint or face) or device PIN.

The user never types a password. The challenge is phishing-resistant, bound to the device, and completes in seconds.

Current Limitations

This is a preview, so there are constraints to be aware of:

• Software-based passkeys only. The feature supports passkeys stored through a software-based provider like Microsoft Authenticator. Hardware security keys and cross-device passkey transfer (e.g., QR code from another device) are not supported in this preview.
• Android only. This specific preview is for Windows App on Android. iOS support is expected to follow, but no timeline has been announced.
• Passkey provider dependency. The passkey must be stored on the same Android device running Windows App. You can’t use a passkey from a different device.

Why It Matters

Phishing-resistant authentication for Cloud PC sessions. Passkeys (FIDO2/WebAuthn) are immune to phishing, replay, and man-in-the-middle attacks — fundamentally stronger than passwords or one-time codes.

Alignment with Microsoft’s passwordless roadmap. With SMS and voice MFA retirement looming in February 2027, organizations need a migration path for in-session authentication. This preview provides that path for Android Cloud PC users.

Better user experience. Users complete in-session challenges with a fingerprint or face scan instead of typing passwords or waiting for SMS codes. For contractors and frontline workers on Android, this reduces friction without compromising security.

Conditional Access integration. Entra ID’s authentication strength policies can require phishing-resistant methods for privileged access. With passkeys available for in-session challenges, admins can enforce those requirements end-to-end — not just at sign-in, but throughout the Cloud PC session.

What IT Admins Should Do

• Enable passkeys in Entra ID. If you haven’t already, configure Passkey (FIDO2) with the Synced profile and target it to users who access Cloud PCs from Android devices.
• Update authentication strength policies. Review your Conditional Access policies and consider requiring phishing-resistant authentication strength for Windows 365 access, particularly for external identities and privileged roles.
• Communicate the MFA migration timeline. Remind users that SMS and voice MFA are being retired. September 1, 2026 is the deadline for passkey registration prompts — ensure your users are ready.
• Pilot the preview. Identify a group of Android-using contractors or employees and have them test in-session passwordless authentication with Windows App and Microsoft Authenticator.

The Combined Impact: Android as a First-Class Cloud PC Client

These two updates, taken together, significantly elevate Android’s position in the Windows 365 ecosystem. Consider a common scenario:

A contractor needs to access a Cloud PC from their personal Android tablet.

Before this update:

• Android support for external identities was limited — the contractor might not be able to sign in at all
• In-session authentication challenges relied on passwords or SMS MFA — both weak, both being deprecated

After this update:

• The contractor signs in to Windows App on Android using their external identity (GA)
• When a sensitive action triggers a re-authentication prompt, they complete it with a passkey stored in Microsoft Authenticator (preview) — biometric verification, no password, no SMS

This is the kind of end-to-end passwordless, Zero Trust access model that Microsoft has been building toward across Entra ID, Windows 365, and the Windows App ecosystem. Android is now part of that story.

Preparation Checklist

What’s Next

Both features are part of Microsoft’s broader push to make Windows 365 accessible and secure across all platforms, with a particular focus on mobile and bring-your-own-device scenarios. The external identity GA is available now, while the in-session passwordless preview is rolling out to eligible tenants.

Expect iOS support for in-session passwordless to follow, given that Microsoft Authenticator passkey support already exists on iOS. Microsoft is also likely to expand the list of supported passkey providers beyond Authenticator as WebAuthn standards mature on Android.

For organizations with significant contractor populations or mobile-first workers, these updates warrant immediate attention. Android is no longer a second-class citizen for Windows 365 access — it’s now a fully supported, passwordless-capable platform.

For more information, see the Windows 365 What’s New documentation, External identity documentation, and Entra ID passkey documentation.

Follow @kkaminski on X for daily Windows 365 updates and analysis.