Microsoft's recent switch to passkeys as the default in Entra ID has sparked discussions among security teams. While the technology is promising, the gap between "passkeys are now default" and "we can turn off passwords" is significant. This post addresses the practical questions teams face in adopting passwordless authentication.
The Challenge of Transitioning to Passkeys
Security teams managing Microsoft environments are on a timeline. By February 1, 2027, Microsoft will phase out SMS and voice authentication. This isn't a suggestion; it's a deadline. Teams must plan for passwordless alternatives or face operational challenges.
Passkeys offer a solution to phishing, using cryptographic key pairs unlocked by biometrics or a PIN. This design prevents fake websites from tricking users into using passkeys on the wrong domain. However, deploying this technology is not straightforward.
Q: Do Passkeys Work with Legacy Apps?
For now, you're likely stuck in a hybrid mode. Passkeys rely on modern web standards like WebAuthn. Older applications, industrial systems, and niche software often don't support these standards.
The practical approach is to deploy passkeys for modern cloud applications where security gains are immediate. For other systems, maintain phishing-resistant MFA or physical tokens. Aim for maximum passkey coverage in high-risk areas like admin access and cloud management, and accept that some systems will require different authentication methods.
Q: How Do We Handle Account Recovery?
Account recovery is a critical area that can undermine passkey security if not handled properly. A weak recovery process can become an attack vector.
To ensure security:
- Avoid SMS or email-based recovery codes.
- Use hardware security keys as backup authenticators.
- Require in-person identity verification for recovery.
- Implement role-based recovery workflows for high-privilege accounts.
Document these processes before deployment to align security with operational needs.
Q: Who Controls Access with Passkey Sync?
When passkeys sync through personal accounts like Apple ID or Google, control issues arise. If an employee is locked out of their personal account, you can't restore their corporate passkey. If they leave the company, their personal devices may still hold synced passkeys.
Consider the trade-offs:
- Platform-synced passkeys improve user experience but tie security to consumer account recovery.
- Device-bound passkeys offer more control but increase support costs.
Choose the model that fits your risk tolerance and support capacity, and build governance around it.
Q: What Risks Do Passkeys Address?
Passkeys eliminate many attack vectors but aren't foolproof.
What passkeys prevent:
- Credential phishing
- Credential stuffing
- Password guessing
- Keylogging
What passkeys don't prevent:
- Device compromise
- Implementation flaws
- Social engineering for account recovery
Passkeys are a significant improvement over passwords with MFA, but they require a comprehensive threat model that includes device security and recovery process integrity.
Q: Should We Roll Out Passkeys All at Once?
A phased rollout is more practical. Start with high-risk users and simple use cases.
- Pilot with IT and security teams to identify issues.
- Deploy to privileged accounts for maximum security benefit.
- Expand to standard users for cloud applications.
- Maintain existing MFA for legacy systems.
Set realistic expectations: this is a multi-year strategy shift, not a quick transition.
Q: How Do We Handle Cross-Platform Access?
Cross-platform access is challenging due to varying passkey implementations by Apple, Google, and Microsoft.
To mitigate issues:
- Use platform-agnostic hardware security keys like YubiKeys.
- Test cross-platform workflows in your pilot phase.
- Clearly communicate user expectations about device compatibility.
Plan for some friction as standards mature and interoperability improves.
Next Steps
For further guidance, refer to NIST SP 800-63 for digital identity and authentication. In regulated environments, align your implementation with access control requirements in NIST SP 800-53 or ISO/IEC 27001.
Before rolling out passkeys, document your account recovery process and have it reviewed externally. This is where security meets operational reality, and it's crucial for a successful deployment.
