Passkeys for business software: plan enrolment, recovery and shared devices

Define the users and devices

List managed laptops, personal phones, shared workstations and external contractors where relevant. Record the operating systems and browsers actually used. A sign-in method that works well for an administrator’s laptop may not meet the needs of staff sharing a reception computer.

For a fictional architecture practice, designers use managed laptops while visiting contractors may need temporary access from approved devices. Write both cases into the trial. Decide which devices may store credentials and who supports a person when the expected device is unavailable.

Understand the credential model

FIDO’s passkey guidance describes cryptographic sign-in credentials and distinguishes synced passkeys from credentials bound to a particular device. The distinction matters for availability across devices and the organisation’s control model.

Do not treat a fingerprint reader as the entire system. The local unlock experience, credential storage, account policy and service support all contribute to the workflow. Ask the supplier to demonstrate the chosen arrangement with the actual account type, rather than assuming every app labelled passwordless behaves identically.

Compare synced and device-bound use

A synced arrangement can make credentials available through a supported provider ecosystem, while a device-bound arrangement stays with its supported authenticator. Evaluate the organisation’s permitted model and the lifecycle of the provider account or physical device. Avoid choosing solely from the convenience of the first sign-in.

For the practice, document what happens when a managed laptop is replaced or a security key is lost. Identify who may approve a new method. Keep the process understandable to staff and support. A credential that is hard to recover can interrupt work even when its normal sign-in experience is straightforward.

Test the ordinary and cross-device journeys

Microsoft’s synced-passkey sign-in guidance documents device-dependent paths and requirements for cross-device use. Verify the relevant browser and device combination rather than assuming a demonstration transfers to every workstation.

Use a harmless test identity to sign in from the normal device and an approved secondary device. Inspect the prompts and the staff instructions needed. If a particular path depends on proximity, connectivity or a supported platform feature, record that dependency so support can distinguish it from an account problem.

Design recovery before broad rollout

Recovery is part of the access design. Avoid an informal shortcut in which anybody with an urgent request receives a new credential. Follow the organisation’s approved identity-verification process and the product’s documented recovery methods. Test the support handover as well as the user interface.

Keep other access paths visible

An application may still allow passwords, recovery codes, administrator resets or integration tokens. List the methods relevant to the rollout and who controls them. A new passkey option does not automatically describe the security of every remaining path.

For the practice, review ordinary user access separately from service integrations. Offboarding a person should include the accounts and assets they operated, using the documented lifecycle controls. The SSO and SCIM guide explains why authentication and provisioning need separate acceptance checks.

Choose a supported operating model

Pilot with a small approved group and collect the actual support issues. Check enrolment, daily sign-in, device change and recovery before expanding. Maintain a named owner for policy changes and staff instructions. Evaluate security properties through the documented configuration rather than promising that one feature removes every account risk.

Research the Microsoft Entra ID, 1Password and Bitwarden profiles. Compare their relevant capabilities against the intended devices and accounts. The right buying result is a sign-in and recovery process the business can reliably support.

Frequently asked questions