What breaks when organisations leave passkey enrollment fully manual?

Why Manual Passkey Enrollment Breaks at Scale

Manual passkey enrollment looks harmless in a pilot, but it becomes a rollout bottleneck once the workforce, device fleet, and help desk queue all grow at the same time. Phishing-resistant authentication only delivers value when adoption is broad and consistent. If enrollment depends on individual initiative, security teams end up with uneven coverage, repeated fallback use, and fragmented assurance across identity providers and endpoints.

The failure is not just user friction. Manual setup also creates a policy enforcement problem: some users enroll quickly, others defer indefinitely, and some never complete the process without support intervention. That leaves a mixed estate where password-based recovery, SMS fallback, or legacy MFA can remain active far longer than intended. Guidance from the NIST AI Risk Management Framework is not about passkeys specifically, but its emphasis on operational governance applies here: controls that depend on user persistence tend to fail unevenly. NHIMG’s research on OWASP NHI Top 10 also shows how weak identity handling becomes a broader exposure multiplier once access patterns fragment.

In practice, security teams usually discover the gap only after enrolment completion stalls, help desk volume spikes, or phishing-resistant coverage is measured and found to be far lower than the rollout plan assumed.

What Manual Enrollment Changes Operationally

Manual passkey enrollment shifts the burden from policy design to user behaviour. That sounds simple, but it changes the control itself. Instead of a predictable, centrally enforced onboarding step, enrollment becomes an opt-in workflow with variable timing, variable completion, and variable support requirements. For a security programme, that means assurance is no longer uniform from day one.

At the identity layer, passkeys are most effective when they are bound to a clear registration policy, device trust signal, and recovery path. If enrollment is manual, organisations often end up with a patchwork of conditions: some users register on managed devices, others on personal devices, and others never complete registration at all. That weakens consistency across authentication strength and increases dependency on fallback methods. The OWASP Agentic AI Top 10 is about a different domain, but its core lesson still applies: controls that rely on voluntary behaviour are brittle when the environment is distributed and fast-moving.

• Adoption slows because users must take a separate action outside the login flow.
• Support costs rise because enrollment failures become help desk cases.
• Fallback authentication stays active longer, preserving weaker paths.
• Assurance becomes inconsistent across device types and identity providers.

NHIMG’s Ultimate Guide to NHIs reinforces a similar operational pattern: identity controls work best when provisioning and lifecycle steps are automated, not left to individual follow-through. These controls tend to break down when large enterprises mix managed and unmanaged endpoints because enrollment state, recovery policy, and device posture stop lining up cleanly.

Where the Standard Answer Stops Being Enough

Tighter enrollment controls often increase rollout overhead, requiring organisations to balance adoption speed against governance quality. That tradeoff becomes sharper in environments with contractors, BYOD, or geographically distributed workforces, where manual setup is more likely to stall and where help desk involvement can become the de facto enrollment engine.

Best practice is evolving, but current guidance suggests treating passkey enrollment as a managed onboarding control rather than a self-service preference. In mature environments, that usually means embedding enrollment into first-login workflows, pairing it with device trust checks, and retiring weak fallback methods on a defined schedule. The goal is not just to get users enrolled. It is to prevent a long tail of partially protected accounts that undermine the security programme. For implementation context, the NIST AI 600-1 Generative AI Profile and the CSA MAESTRO agentic AI threat modeling framework both reflect the broader principle that security controls must be operationally enforceable, not merely recommended.

One useful exception is phased rollout in a small, highly managed population where manual enrollment can be acceptable as a temporary transition step. Outside that narrow case, best practice is to automate enrollment prompts, monitor completion rates, and remove legacy fallback paths as soon as assurance thresholds are met.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on manual user provisioning in large trust ecosystems?
• What breaks when organisations rely on manual logs instead of continuous access intelligence?
• What breaks when organisations rely on manual GRC updates instead of workflow automation for evidence collection and policy enforcement?
• When should organisations prioritise enrollment-based access over manual provisioning for unmanageable applications?