Notifications
Clear all
Topic starter
16/08/2026 1:12 pm
TL;DR: Passkeys are becoming easier to enable, store, share, and delete across Apple, Google, and Microsoft ecosystems, with platform-specific steps for iCloud Keychain, Google Password Manager, and Windows Hello, according to Descope. The governance question is no longer whether passkeys work, but how identity teams manage portability, recovery, and lifecycle consistency across devices and accounts.
NHIMG editorial — based on content published by Descope: Managing Passkeys on Apple, Google, and Microsoft Platforms
Questions worth separating out
Q: How should security teams govern passkeys for shared application accounts?
A: Security teams should treat the shared account as the governed object and the passkey as the authentication method attached to it.
Q: When does passkey adoption create new governance risk?
A: Risk increases when organisations treat passkeys as a pure authentication upgrade and ignore recovery, device loss, and enrolment governance.
Q: What do teams get wrong about passkey security?
A: Teams often assume passkeys are either perfect or too risky to adopt.
Practitioner guidance
- Define platform ownership for passkey lifecycle management Assign a clear owner for enrollment, sharing, deletion, and recovery across Apple, Google, and Microsoft ecosystems so users are not left with conflicting cleanup paths.
- Document approved recovery methods before rollout Require trusted recovery methods for lost-device scenarios and test that those methods do not fall back to weak, reusable secrets.
- Set rules for shared passkey exceptions Allow shared groups only for explicitly approved use cases, and tie them to named owners who can revoke access when the relationship changes.
What's in the full article
Descope's full article covers the platform-specific operational steps this post intentionally leaves for the source:
- Step-by-step passkey enrollment and deletion flows for iOS, macOS, Android, Chrome, and Windows 11.
- Platform-specific sharing workflows, including AirDrop, shared groups, Google Password Manager sync, and Windows Hello.
- Device and account settings needed to enable passkeys, such as iCloud Keychain, two-factor authentication, and Windows Hello setup.
- Practical handling details for users who need to manage passkeys across multiple browser and operating system combinations.
👉 Read Descope's guide to managing passkeys across Apple, Google, and Microsoft →
Passkey management across major platforms: what IAM teams should know?
Explore further
16/08/2026 1:14 pm
Passkey management is a human identity lifecycle problem, not just an authentication upgrade. The article shows that passkeys are only useful when enrollment, sync, sharing, deletion, and recovery are all governed as one process. That is the same lifecycle discipline IAM teams already apply to passwords and MFA, but the control points move into device and cloud account ecosystems. Practitioners should stop treating passkeys as a point feature and govern them as an identity state that can be created, shared, lost, and revoked.
A few things that frame the scale:
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
A question worth separating out:
Q: How do organisations know whether passwordless access is actually improving security?
A: Look for reduced password dependence, fewer lockouts, lower help desk reset volume, and stronger control over high-risk workflows such as shared workstation access and privileged clinical systems. If user friction drops while identity assurance rises, the programme is moving in the right direction.
👉 Read our full editorial: Managing passkeys across Apple, Google, and Microsoft platforms
