I have seen an exception to this with Microsoft Entra. I was not able to store and use the passkey in my password manager of choice, I had to save it in Microsoft Authenticator. I haven't tried again lately since that was for a previous job, and I didn't look into the underlying reason it failed, whether it was attestation of some sort or something else about how they set it up.

I'm generally pro-passkeys, but also acknowledge they are a hot mess for the average non-techy consumer. And there does seem to be room for the screws to tighten, and we definitely need to resist that.

Microsoft also didn't let me use a normal TOTP authenticator and it wouldn't let me sign in with just my password. Every step along the way of a corporate MS account is bullshit, passkeys are just a victim of enterprise policies.

Microsoft Entra is a workforce product. An employer always decides how you authenticate to your work account. It's not your account.