Clarification Required: Mandatory Passkeys for Privileged Users with Microsoft Entra SSO

Hi everyone,

We use Microsoft Entra SAML SSO with MFA for Salesforce. Normal users can authenticate using Microsoft Authenticator, but privileged users are being forced to create a separate Salesforce passkey.

Is a passkey or phishing-resistant MFA now mandatory for all privileged Salesforce users? Is there any supported way for privileged users to continue using Microsoft Authenticator push through Entra SSO without creating a Salesforce passkey?

Any advice or working configuration would be appreciated.