Passkeys and WebAuthn for company logins

What is a passkey?

A passkey is a sign-in credential based on FIDO standards that can be stored on a phone, a computer or a hardware security key.^[2] Instead of a password that the user and the server both know, it is a key pair. The private key stays with the user's authenticator; the service keeps only the public key.

When someone signs in, the service sends a challenge, the authenticator signs it once the user confirms with a fingerprint, face or PIN, and the service checks the signature against the stored public key. There is no shared secret on the server for an attacker to copy and replay elsewhere.

How do passkeys resist phishing?

The key word in that definition is scoped. A WebAuthn credential can only be used by origins that belong to the relying party that created it.^[1] If an employee follows a link to a lookalike login page, the browser does not offer the real site's passkey there, so there is nothing for the fake page to capture.

That is the gap passkeys close. CISA lists the ways attackers get around older forms of MFA: phishing pages that collect a password and a one-time code, push bombing until a user taps Accept, abuse of SS7 telephone signaling to read SMS codes, and SIM swaps.^[4] It describes FIDO/WebAuthn as "the only widely available phishing-resistant authentication" and urges administrators and other high-value targets to move to phishing-resistant MFA.^[4]

Lookalike domains are a common way to reach staff in the first place. Our guide to executive impersonation covers how those lures are built.

Synced or device-bound passkeys?

The FIDO Alliance notes that passkeys can be synced across a user's devices or bound to one device.^[2] The difference matters for policy:

• Synced passkeys live in a passkey provider, such as a platform keychain or a password manager, and are available on the user's other signed-in devices. WebAuthn calls these multi-device credentials and records in each sign-in whether a credential is eligible for backup and whether it is backed up.^[1]
• Device-bound passkeys never leave one device, such as a security key or an authenticator app.^[2]

Synced passkeys are easier for staff because a lost phone does not mean a lost credential. Device-bound passkeys give the organization more certainty about where the key is.

What does NIST say about passkeys?

NIST SP 800-63B-4, the current US digital identity guideline, requires verifiers to offer at least one phishing-resistant option at authentication assurance level 2 (AAL2), and AAL3 requires a phishing-resistant authenticator.^[3]

Because a syncable authenticator's private key must be exportable, NIST states that syncable authenticators "SHALL NOT be used at AAL3".^[3] It also advises enforcing AAL2 requirements for access to the sync service that holds exported keys and, in federal enterprise use, limiting key transfer to organizationally managed or trusted devices.^[3] Private companies are not bound by these rules, but they are a sound model for deciding who gets which kind of passkey.

How do identity providers control passkeys?

Most of the policy work happens in your identity provider. Microsoft Entra ID is one documented example. It supports synced passkeys and device-bound passkeys on FIDO2 security keys and in Microsoft Authenticator.^[5] Its passkey profiles let administrators set, per group, whether attestation is enforced, which passkey types are allowed, and which authenticator models are allowed or blocked by their AAGUID, an identifier for the make and model.^[5]

Two details from that documentation shape real rollouts. Synced passkeys do not support attestation, so Microsoft advises treating them as phishing-resistant but with the same security posture as other unattested authenticators.^[5] And users must have completed MFA within the past five minutes before they can register a passkey.^[5] Check the equivalent settings in whichever identity provider you use.

How should a company roll out passkeys?

A phased plan avoids most lockouts:

1. Inventory sign-ins. List the apps behind your identity provider and the ones that still keep their own passwords.
2. Set policy by group. Device-bound passkeys for administrators, finance approvers and executives; synced passkeys allowed for general staff.
3. Enroll in waves. Start with the IT team, then high-risk roles, then everyone else, with a short guide for each device type.
4. Make recovery safe. A help desk reset that only asks for a name and an employee number undoes the gain. Require identity checks that an attacker on the phone cannot pass.
5. Retire weaker methods. Once a group has passkeys, require them for sensitive apps through conditional access, then remove SMS and other phishable fallbacks.
6. Watch the logs. Alert on new passkey registrations, especially for privileged accounts.

What should you watch for after rollout?

Passkeys protect the sign-in step. They do not protect a session cookie once it has been issued, so malware that steals cookies can still take over an account. Our guide to session hijacking and infostealers covers that layer. The executive cybersecurity checklist puts passkeys alongside the other basics for leaders' accounts.

Where does this fit with domain security?

Phishing campaigns against staff often start with a lookalike domain or a spoofed sender. Passkeys make the stolen password useless; email authentication and domain monitoring make the lure harder to send. Our guide to corporate DNS security covers SPF, DKIM and DMARC. Passkey rollout is identity work your IT team or identity provider owns; our domain security service covers domain ownership, locks and DNS records as part of our digital asset security work.