Passwordless authentication and lifecycle control for enterprise identities

At a glance

What this is: This is a customer-style account of passwordless authentication and PKI lifecycle management, showing how an enterprise combined smart cards, YubiKeys, self-service issuance, and device lifecycle controls to support secure access.

Why it matters: It matters because IAM teams rarely fail on authentication alone, they fail when authenticator issuance, proofing, and lifecycle governance are not managed as one operating model across human and non-human access paths.

Context

Passwordless authentication replaces passwords with stronger authenticators such as smart cards, hardware keys, and managed device-based access. In this article, the governance issue is not the login method itself, but whether issuance, recovery, and replacement are controlled across the full authenticator lifecycle.

Axiad’s customer example shows why enterprise identity programmes often stall when MFA, PKI, and device onboarding are run as separate efforts. The operational burden shifts to users and support teams unless authenticator lifecycle control is built into the access model from the start.

Key questions

Q: How should organisations govern passwordless authentication without losing lifecycle control?

A: They should treat passwordless as an identity governance programme, not a login project. That means assigning ownership for issuance, renewal, revocation, and exception handling, then verifying that certificate and key lifecycle events are linked to joiner-mover-leaver processes. If revocation is unreliable, passwordless reduces friction without reducing risk.

Q: When does self-service authenticator recovery create more risk than it removes?

A: It creates more risk when the recovery path is easier to use than the normal authentication path and the proofing step is weak. In that situation, attackers target fallback workflows, not primary login. Strong recovery requires explicit approval rules, auditable proofing, and tight limits on who can reissue authenticators.

Q: What breaks when certificate lifecycle management is not integrated with PKI operations?

A: Manual certificate management does not scale once certificate counts rise and lifetimes shrink. Without integrated lifecycle management, renewals become inconsistent, revocations lag, and teams lose visibility across internal, public, and cloud-native authorities. That creates outage risk and weakens trust assurance, especially in environments with many applications, workloads, and device identities.

Q: Should organisations prioritise self-service authenticator issuance over help desk handling?

A: Only when the self-service path includes strong proofing, clear approval rules, and automatic lifecycle updates. Otherwise, self-service simply shifts risk from the help desk to the recovery channel. The right priority is to reduce manual tickets without weakening the governance around authenticator legitimacy and ownership.

Technical breakdown

Passwordless authentication depends on authenticator governance

Passwordless does not mean password-free and ungoverned. It means the enterprise has shifted trust from memorised secrets to managed authenticators such as YubiKeys, smart cards, and device-bound credentials. The technical dependency is stronger, not weaker, because every authenticator now needs issuance, binding, replacement, and revocation controls. If those controls are fragmented, users can regain access too easily, lose access too often, or accumulate unmanaged authenticators across accounts and devices.

Practical implication: Treat passwordless access as an authenticator lifecycle programme, not a login UX change.

PKI smart cards and hardware keys need lifecycle alignment

PKI-based authentication introduces certificate-backed trust, which only works when certificate issuance, renewal, and revocation are aligned with identity status and device status. Smart cards and hardware keys are effective only when the issuing process, proofing step, and replacement path are tightly governed. If a user is locked out, changes role, or leaves the organisation, the certificate lifecycle has to follow the identity lifecycle. Otherwise, the organisation creates a durable trust object with unclear ownership.

Practical implication: Align certificate lifecycle management with joiner-mover-leaver processes and device ownership.

Self-service issuance reduces friction but raises proofing requirements

Self-service authenticators reduce help desk dependency by letting users request, issue, or replace credentials without manual intervention. That convenience only remains safe when the identity proofing step is strong enough to distinguish a legitimate recovery event from account takeover activity. Features like trusted-colleague verification add a human checkpoint, but they also create a governance dependency: recovery must be bound to a documented trust model, not an ad hoc support decision.

Practical implication: Define who can approve recovery, under what proofing rules, and for which authenticator types.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passwordless authentication succeeds only when authenticator lifecycle control is part of the identity architecture. The central error in many programmes is treating the authenticator as a login substitute rather than a governed object with issuance, binding, recovery, and revocation states. Axiad’s customer example reflects that shift clearly. The practitioner lesson is that passwordless cannot be separated from lifecycle governance without creating operational drift.

Authenticator self-service is a governance design choice, not a convenience feature. When users can issue or replace authenticators themselves, the enterprise reduces ticket volume but also moves more trust into the recovery path. That changes the control question from “can the user log in?” to “who vouches for authenticator legitimacy when the normal path breaks?” The implication is that recovery workflows become part of the security model, not the support model.

PKI, hardware keys, and device management belong in one control plane. The article shows these functions being used together, which is exactly how mature identity programmes should think about them. If certificates, hardware authenticators, and device lifecycle are managed separately, the organisation creates uneven enforcement and inconsistent user experience. The practitioner conclusion is that fragmentation, not passwordless itself, is what creates the real governance gap.

Identity proofing becomes the backstop for passwordless recovery and replacement. The moment a user can no longer present the primary authenticator, the organisation must rely on proofing and recovery trust decisions. That is where weak governance shows up most quickly. The lesson for IAM leaders is to define recovery authority as tightly as primary authentication authority, because the exception path is where account takeover risk concentrates.

Device lifecycle management is now an authentication control, not just an endpoint task. In a passwordless model, device state can determine access state. That makes enrollment, replacement, and deprovisioning part of access governance rather than simple IT hygiene. The practical conclusion is that identity and device teams have to coordinate on the same lifecycle events if passwordless is meant to stay secure over time.

What this signals

Authenticator lifecycle control is the hidden dependency in passwordless programmes. Organisations often focus on the login ceremony, but the real security work sits in issuance, recovery, replacement, and revocation. Once those states are governed consistently, passwordless becomes a lifecycle discipline rather than a collection of convenience features.

PKI and hardware keys should be treated as governed identity objects. In practice, that means the certificate or key cannot be managed in isolation from the person, device, and support workflow that owns it. Programme owners should expect the strongest control failures to appear in exception handling, not in everyday login.

Self-service can reduce operational drag only when recovery is tightly bounded. If users can replace credentials without a strong proofing step, the convenience gain will come at the expense of assurance. Identity teams should watch the exception path because that is where passwordless programmes either mature or drift.

For practitioners

• Tie passwordless to authenticator lifecycle governance Define issuance, renewal, replacement, and revocation rules for every authenticator type before broad rollout. The same policy should govern smart cards, hardware keys, and any self-issued credential path.
• Bind recovery to identity proofing Require a documented proofing step for replacement and lockout recovery, including explicit approval rules for trusted-colleague workflows and help desk escalation.
• Map PKI to joiner-mover-leaver events Synchronise certificate and key ownership changes with job changes, device replacement, and offboarding so access does not outlive the identity state that justified it.
• Reduce support exceptions around credential reissue Measure how often users need manual authenticator recovery and remove recurring exception paths by improving self-service, proofing, and device enrollment flows.

Key takeaways

• Passwordless authentication improves user experience only when authenticator issuance, proofing, and revocation are governed together.
• The article’s example links smart cards, YubiKeys, self-service issuance, and device lifecycle management into one operating model rather than separate projects.
• The security lesson is to align passwordless controls with identity lifecycle events so recovery and replacement do not become weak points.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Authenticator Lifecycle Management: Authenticator lifecycle management is the governance of a credential from issuance to renewal, replacement, and retirement. For human identity programmes, it ensures that keys, smart cards, and certificates stay tied to the right user and are removed when the user, role, or device is no longer trusted.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• PKI Certificate Lifecycle: The PKI certificate lifecycle is the governed process of issuing, storing, renewing, and revoking digital certificates. It matters because certificates are trust credentials for machines and services, so lifecycle failures can create expired trust, orphaned access paths, or compliance gaps.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.