We have migrated to Entra ID passkeys and recently learned that ProjectWise Drive (authenticated via Bentley IMS - federated to our Entra ID) does NOT support FIDO passkey authentication and is unable to use the proper Windows/Session APIs to connect. When we attempt to authenticate, ProjectWise Drive guides us through the username > password workflow, but then at the passkey MFA step, it responds that we must register and does not recognize my existing registered FIDO/passkey methods (Windows Hello or Authenticator passkey)

In contrast, Bentley CONNECTION Client does support this authentication flow. I am able to log in seamlessly to that software with my passkey authentication session without issue.

We are working on a solution to exclude the users of this application from our MFA conditional access policy for that app in particular, but obviously we would like to have passkeys work seamlessly with Drive so we can secure this application. It seems that the easiest way would be to hand off the authentication from ProjectWise Drive native auth - and offload that to CONNECTION Client which does support this method.