Notifications
Clear all
Topic starter
11/07/2026 8:44 pm
TL;DR: Passwords still drive most account compromise, and Microsoft’s Digital Defense Report says phishing causes 70% of data breaches, making hardware-backed, device-bound FIDO2 passkeys a stronger control than traditional MFA for enterprise authentication. The real challenge is not adoption alone but lifecycle governance, because passwordless credentials still need issuance, revocation, reissue, and audit discipline.
NHIMG editorial — based on content published by Versasec: Simplify FIDO2 Passkey Management with Microsoft and Versasec
Questions worth separating out
Q: How should security teams govern passkeys in enterprise environments?
A: Treat passkeys as managed credentials, not as a one-time authentication upgrade.
Q: Why do device-bound passkeys reduce phishing risk more effectively than passwords?
A: Device-bound passkeys keep the private key on the physical authenticator, so an attacker cannot steal or replay it from a phishing page the way they can with passwords.
Q: What do organisations get wrong about passwordless authentication?
A: They often focus on user convenience and ignore credential lifecycle governance.
Practitioner guidance
- Prioritise device-bound passkeys for high-risk accounts Set policy to favour hardware-backed, non-exportable authenticators for administrators and other sensitive users, and limit syncable passkeys where enterprise control over device state is weak.
- Embed passkey events into identity lifecycle workflows Tie issuance, PIN recovery, revocation, and reissue to joiner-mover-leaver processes so the credential is governed from enrollment to retirement.
- Create a single audit trail for passwordless administration Ensure the identity team can trace who approved a passkey, which device it was bound to, and when it was revoked or replaced.
What's in the full article
Versasec's full post covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for managing FIDO2 security keys across provisioning, replacement, and revocation workflows
- Practical details on integrating passkey management with Microsoft Entra ID in hybrid identity environments
- Operational examples for unblocking PINs, reissuing devices, and maintaining audit trails for passwordless administration
- Details on automating passkey administration while keeping policy enforcement and compliance evidence consistent
👉 Read Versasec's guidance on FIDO2 passkey management with Microsoft →
FIDO2 passkeys and Entra ID: what changes for identity teams?
Explore further
11/07/2026 9:12 pm
Device-bound authentication is now a governance question, not just a cryptography question: FIDO2 passkeys reduce phishing exposure, but the operational risk moves to authenticator governance, issuance policy, and revocation discipline. A strong private key does not help if the organisation cannot prove which device owns it, who approved it, and when it was retired. Practitioners should treat passkeys as governed credentials with full lifecycle accountability.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Who is accountable when a passkey is lost, replaced, or revoked incorrectly?
A: The accountability sits with the identity and access management function, because it owns authenticator policy, lifecycle evidence, and exception handling. If the organisation cannot show who approved the credential and when trust was removed, it does not have controlled passwordless governance.
👉 Read our full editorial: FIDO2 passkey management shifts the control plane for human IAM
