Topic starter
11/10/2026 6:56 pm
TL;DR: Synced passkeys can meet AAL2 when the sync service is encrypted and itself protected by AAL2-grade MFA, according to Crayonic, but they SHALL NOT be used at AAL3 because the top assurance level requires a non-exportable private key. That boundary makes passkey placement a governance decision, not a default rollout choice.
Editorial analysis by NHI Mgmt Group, based on content published by Crayonic: “Synced vs device-bound passkeys: which one belongs where”.
Key questions
Q: How should security teams decide where to use syncable passkeys versus device-bound keys?
A: Use syncable passkeys where usability and scale matter most, but keep device-bound keys for privileged access, regulated workflows, and any application where the organisation must preserve a stronger device-to-credential binding.
Q: What breaks when passkey recovery is not governed properly?
A: The programme falls back to the weakest legacy recovery path, which attackers often target first.
Q: Why do privileged accounts usually need device-bound passkeys?
A: Privileged accounts need the strongest practical binding between the authenticator and the device or token carrying it.
Practitioner guidance
- Segment users by assurance requirement Classify accounts into customer, workforce, privileged, shared-workstation, and restricted-device groups before assigning synced or device-bound passkeys.
- Remove weak fallback methods Disable SMS, email links, and other phishable fallbacks for admin, critical-system, and regulated-access groups so recovery does not undercut passkey strength.
- Treat recovery as authentication Require identity re-checks and a second authenticator before issuing replacement credentials, because recovery now functions as part of the login path.
Bottom line: Synced passkeys improve usability, but their assurance depends on the sync account, recovery path, and device trust boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 6:57 pm
Passkey policy is now an assurance policy, not a login preference. The real decision is which roles can tolerate a recoverable private key and which roles require an uncompromisable authenticator. Synced passkeys increase usability, but device-bound keys preserve a stronger assurance boundary for privileged and regulated access. Practitioners should stop treating passkey rollout as a single enterprise standard and instead define assurance tiers by role.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: How do managed devices change passkey governance for the workforce?
A: Managed devices let identity teams pair passkeys with a known hardware and policy boundary, which makes synced credentials safer for some staff but still unsuitable for others. Once users operate on shared workstations, personal cloud accounts, or unmanaged endpoints, the passkey policy has to tighten or shift to device-bound authentication.
👉 Read our full editorial: Synced passkeys work for most users, but not every role