What breaks when unmanaged devices can use enterprise passkeys?

Why unmanaged devices break enterprise passkey trust

Enterprise passkeys are strong only when the organisation can trust the device that stores or presents them. unmanaged endpoint break that trust because they sit outside the normal corporate controls for posture checks, inventory, patching, and recovery. The result is not weaker cryptography, but weaker assurance about who can use the credential, where it can be used, and how quickly it can be revoked.

Once a passkey can be used from an endpoint the business does not manage, the organisation no longer has a reliable enforcement point for its own access policy. That changes the meaning of “phishing-resistant” from a control on the sign-in ceremony to a broader trust question about device compliance, possession, and recoverability.

What disappears from the control boundary

The first thing that breaks is endpoint assurance. Managed-device checks often support decisions about whether a user may enrol, authenticate, or recover access. If unmanaged devices are allowed, those checks become advisory at best, which means the organisation may be issuing high-confidence authentication without high-confidence device governance.

The second thing that breaks is lifecycle control. Offboarding, lost-device response, and step-up enforcement become less predictable when the endpoint is not under MDM policy or EDR coverage. That gap matters because passkeys are often valued for reducing phishing and password theft, but they still need an accountable device boundary to keep access bounded over time.

The third thing that breaks is visibility. Security teams lose telemetry that would normally help them correlate authentication events with device health, location, and compromise signals. Without that visibility, the passkey becomes harder to distinguish from a legitimate corporate session when it is actually being used from an unmanaged environment.

Why the risk is operational, not just technical

Allowing unmanaged devices into enterprise passkey flows creates a shadow access path. Users may succeed in authenticating while bypassing the controls that the organisation depends on to enforce compliance, investigate incidents, and prove that the endpoint met baseline standards at the time of access.

That creates a policy mismatch: the access decision says “trusted,” while the operating reality says “unknown.” Over time, that mismatch can erode confidence in the whole passkey programme, because the business may discover that strong authentication is not the same as controlled device trust.

How to keep passkeys strong without loosening endpoint governance

The most useful design rule is to separate the credential from the endpoint trust decision. A passkey can still be part of a phishing-resistant login flow, but unmanaged devices should trigger explicit policy choices rather than implicit approval. If the organisation cannot attest the device, it should decide whether to block, restrict, or step up access rather than silently accept lower assurance.

For policy design, Passwordless and Passkeys Guide is the best internal reference for understanding how passkeys, recovery, and rollout choices affect the trust model. For broader device and workforce identity control, Workforce Identity Security Guide helps connect sign-in assurance to joiner-mover-leaver discipline and endpoint-bound access decisions.

Practitioner Guidance

What to verify: Confirm whether passkey enrolment, step-up, and recovery are allowed from unmanaged endpoints, and whether that policy matches your intended assurance level. If the answer depends on browser prompts alone, the control is weaker than it looks.

Decision rule: If the device cannot be attested or inventoried, treat the session as lower assurance even if the passkey authentication itself succeeds. Do not let phishing-resistant authentication become a substitute for endpoint trust.

What practitioners underestimate: The biggest failure mode is not credential theft, it is policy drift. Teams often harden the sign-in method but leave recovery, offboarding, and exception handling open enough that unmanaged devices quietly become a sanctioned back door.

Practitioner takeaway: Enterprise passkeys should strengthen identity assurance, not bypass device governance; if the endpoint is outside corporate control, the access decision must change accordingly.

Related resources from NHI Mgmt Group

• What breaks when contractors are allowed to use unmanaged devices without central controls?
• What breaks when remote workers use unmanaged endpoints to access enterprise systems?
• How should security teams authenticate AI agents in enterprise environments?
• What breaks when unmanaged devices can still access business apps?