Topic starter
04/06/2026 6:43 pm
TL;DR: C1.ai shows that passwordless onboarding still often begins with a temporary password or passcode, so the first credential remains a day-one exposure even when the end state is passkey-based authentication. The governance problem is whether joiner workflows can remove that interim secret entirely before enrollment.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “Your Passwordless Rollout Has a Password in It”.
Key questions
Q: What breaks when device onboarding still relies on passwords?
A: Password-based device onboarding creates shared secrets, slow revocation, and weak accountability.
Q: Why does a bootstrap credential still matter if the end state is passkeys?
A: Because the first credential is what establishes trust before the user can enrol a stronger factor.
Q: What signs show that passwordless onboarding is not fully governed?
A: Watch for passwords or passcodes appearing in welcome emails, help desk scripts that read credentials aloud, long-lived bootstrap credentials, and manual handoffs between HR, IT, and the IdP.
Practitioner guidance
- Map the joiner secret lifecycle Document every step from HR event to first passkey enrolment and identify where a temporary password, passcode, or access pass is created, delivered, stored, and revoked.
- Shorten bootstrap validity windows Set the temporary credential lifetime as tightly as the onboarding schedule allows and prefer one-time use where the business process can support it.
- Remove inbox delivery where possible Replace plaintext delivery to email with a lower-exposure handoff path or verified out-of-band channel so the bootstrap secret is not sitting in a mailbox before first use.
Bottom line: The post shows that passwordless onboarding can still start with a temporary secret, which leaves a first-day exposure window even when the target state is passkey-based authentication.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The step-by-step joiner workflow that issues a temporary access pass and hands it to the new user
- The Entra ID and Graph API sequence used to create and expire the bootstrap credential
- The email delivery pattern for sending the first-use credential to the user or manager
- The article's sample automation path from HRIS event to passkey enrolment
👉 Read C1.ai's analysis of passwordless onboarding and day-one password risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 6:54 pm
Day-one credential exposure is a governance failure, not just an implementation detail: passwordless programmes still break down when the joiner workflow creates a temporary secret to bridge the gap to passkey enrolment. That secret is often the first and weakest credential the user ever receives, which means the identity programme has not actually removed password risk at the point where trust is being established. The implication is that onboarding design, not just authentication policy, determines whether passwordless is real.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: How should IAM teams govern the first credential in a passwordless joiner flow?
A: Treat it as a tightly scoped enrolment token, not as a normal login secret. Limit who can issue it, keep the lifetime short, control the delivery path, and require passkey registration immediately after first use so the bootstrap secret cannot linger.
👉 Read our full editorial: Passwordless user onboarding still hides a day-one password risk