Managed passkeys are passkeys that an organisation provisions, governs and can revoke through central identity controls. They use public key cryptography and authenticator management to bind a credential to a user account, while keeping the private key on the device or secure authenticator. Administrators can set policy for enrolment, recovery, access and deletion.
How managed passkeys work
Managed passkeys are centrally governed credentials built on public key cryptography. The organisation controls enrolment, policy and revocation, while the private key stays on the user device or secure authenticator, reducing password handling without removing administrative oversight.
That management layer matters because it changes passkeys from a purely user-held authenticator into an identity control with lifecycle ownership. Instead of treating sign-in as a one-time setup, organisations can define who may enroll, how recovery works, when a credential expires, and how deletion or revocation is enforced.
Managed passkeys typically sit inside a broader authentication programme, not as a standalone feature. They work best when the surrounding identity system can recognise the account, establish trust in the authenticator, and apply consistent policy across devices, platforms and recovery paths.
Why managed passkeys are different from consumer passkeys
The main distinction is governance. Consumer passkeys are usually created and stored with limited central control, while managed passkeys are tied to enterprise policy, admin oversight and account lifecycle management. That makes them more suitable for environments where access must be provable, reversible and auditable.
In practice, this distinction affects how organisations design recovery and offboarding. If a passkey is lost, replaced or suspected of being compromised, central control must let the organisation restore access without weakening the phishing-resistant model. If an employee leaves, the organisation needs to revoke the credential cleanly rather than relying on the user to remove it.
Managed passkeys also change the trust model for support teams and help desks. Recovery workflows become part of the security design, because weak recovery can reintroduce the same social engineering paths that passwords and one-time codes often suffer from.
Passwordless and Passkeys Guide
Security properties and operational value
Because the private key stays on the authenticator, managed passkeys are designed to resist phishing, replay and credential stuffing better than shared secrets. The cryptographic binding also makes them more precise than a generic second factor, since the authenticator proves possession of the private key during sign-in.
The operational value is not only stronger login security, but better control over the credential lifecycle. Administrators can define enrollment policy, recovery constraints, approved authenticators and deletion rules, which helps reduce orphaned access and inconsistent sign-in behaviour across a fleet.
That said, the security outcome depends on the management process as much as the cryptography. A passkey system with weak provisioning, poor recovery or loose admin controls can still create exposure even if the underlying authentication ceremony is strong.
FIDO2 and WebAuthn Internals Guide
Where managed passkeys fit in modern identity programs
Managed passkeys are most valuable where organisations want phishing-resistant authentication with lifecycle governance. They fit naturally alongside SSO, conditional access, account recovery controls and identity policy because they are not just a login method, they are a governed authentication asset.
They are especially relevant for workforces and other managed populations where IT needs to provision, track and revoke access at scale. In those environments, the question is not whether passkeys are usable, but whether the identity platform can operate them consistently across devices, browsers and recovery scenarios.
As a result, managed passkeys should be designed as part of the account lifecycle, not bolted on after the fact. If the organisation cannot answer who enrolled the credential, how it was recovered and how it will be revoked, the “managed” part is incomplete.
Workforce Identity Security Guide
Risk and Threat Considerations
Managed passkeys reduce password-based attack paths, but they also concentrate trust in provisioning, recovery and administrative control. If those processes are weak, an attacker may target the help desk, recovery workflow or device enrollment path instead of trying to break the cryptography.
Failure mechanism: Social engineering, account recovery abuse, compromised admin tooling or poor revocation hygiene can let an attacker add, replace or retain a passkey on an account that should no longer be accessible.
Impact: The result can be persistent unauthorized access, especially when a compromised or stale passkey remains trusted after a device loss, employee departure or support-assisted recovery.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines phishing-resistant authenticators and lifecycle expectations for passkey-based authentication. |
| Recommendation — Apply NIST 800-63 guidance to govern passkey enrollment, recovery and assurance requirements. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Managed passkeys are centrally issued and revoked authenticators with lifecycle control. |
| IA-2 — Identification and Authentication (Organizational Users) | Managed passkeys authenticate workforce users through centrally governed identity systems. | |
| AC-2 — Account Management | Managed passkeys depend on account enrollment, lifecycle changes and revocation governance. | |
| Recommendation — Use IA-5 to control issuance, rotation, revocation and protection of managed passkeys. Use IA-2 to enforce strong user authentication with managed passkeys. Use AC-2 to align passkey enrollment and revocation with account lifecycle events. | ||
| CIS Controls v8 | CIS-5 — Account Management | Managed passkeys require controlled provisioning, revocation and ownership of user access. |
| Recommendation — Implement CIS-5 to govern account provisioning and deprovisioning for passkey use. | ||
Practitioner Guidance
Governance implication: Treat managed passkeys as lifecycle-controlled credentials, not just a sign-in convenience. Ownership should cover enrollment policy, recovery approval, revocation authority and auditability so that the security team can answer who can create, use and remove a passkey.
What to watch for: Pay close attention to recovery design, device replacement flows and support desk procedures, because those are the points where phishing-resistant authentication is most often weakened in practice.
Practitioner takeaway: Managed passkeys are strongest when the cryptography and the identity lifecycle are governed together.
Related resources from NHI Mgmt Group
- What breaks when passkeys are tied only to a single device instead of a managed vault?
- What is the difference between building passkeys from scratch and using a managed workflow to deploy them?
- How should security teams design sign-in flows that work across passwords, passkeys, 2FA, social logins, and managed apps?
- Why do passkeys reduce phishing and credential theft risk on managed Macs?