Topic starter
16/08/2026 1:12 pm
TL;DR: Passkeys are becoming easier to enable, store, share, and delete across Apple, Google, and Microsoft ecosystems, with platform-specific steps for iCloud Keychain, Google Password Manager, and Windows Hello, according to Descope. The governance question is no longer whether passkeys work, but how identity teams manage portability, recovery, and lifecycle consistency across devices and accounts.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Managing Passkeys on Apple, Google, and Microsoft Platforms”.
Key questions
Q: How should IAM teams govern passkeys across multiple platforms?
A: Treat passkeys as lifecycle-managed authenticators, not as a one-time login feature.
Q: Why do cross-platform passkeys create governance risk?
A: Because the credential can exist in more than one control plane at the same time.
Q: What breaks when passkey deletion is not tied to offboarding?
A: The identity may remain valid on one or more synced devices even after the account owner should no longer have access.
Practitioner guidance
- Standardise passkey lifecycle ownership Assign clear ownership for enrolment, sync, recovery, and deletion across each platform ecosystem so the same user does not end up governed by three different operational teams.
- Map platform-specific recovery paths Document how users regain access after device loss on Apple, Google, and Windows, then align those paths with your identity assurance requirements.
- Treat passkey sharing as delegated access Set policy for when AirDrop, shared groups, or similar transfer features are permitted, and require review for any shared authentication path.
Bottom line: Passkeys improve authentication resilience, but they also move the core control problem into identity lifecycle governance across platform ecosystems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/08/2026 1:14 pm
Passkeys shift the identity control plane from memorised secrets to managed device trust. The article is not really about convenience features on Apple, Google, and Microsoft. It is about the fact that authentication now depends on where a credential is stored, synchronised, and deleted across platform ecosystems. For IAM programmes, that means the control point moves from password policy to lifecycle governance of a distributed credential.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What is the difference between passkey syncing and passkey sharing?
A: Syncing copies the same credential across a user's trusted devices through the platform's account ecosystem, while sharing transfers access to another person or group through an explicit platform feature. The first supports continuity for the same identity, while the second extends authentication capability to others and therefore needs stronger governance.
👉 Read our full editorial: Managing passkeys across Apple, Google, and Microsoft platforms