Why does passwordless authentication still need strong deprovisioning?

Why This Matters for Security Teams

passwordless authentication removes passwords from the login flow, but it does not remove the need to revoke access when an identity changes role, leaves the organisation, or is no longer trusted. That is the gap security teams still miss: modern authentication can reduce credential theft, yet access persistence remains a lifecycle problem. The operational issue is deprovisioning, not the factor used to sign in.

NHI Management Group’s research shows how serious lifecycle failures can be, with only 20% of organisations having formal processes for offboarding and revoking API keys, and with 91.6% of secrets still valid five days after notification in many cases. Those findings align with the broader control model in the NIST Cybersecurity Framework 2.0, which treats identity governance and recovery as ongoing duties, not one-time setup tasks. The same logic applies to passwordless users, administrators, service accounts, and delegated access paths.

In practice, many security teams discover retained access only after a departure, contract end, or compromise response has already created an exposure window, rather than through intentional lifecycle testing.

How It Works in Practice

Strong deprovisioning means removing every access path that a former user can still use, including device-bound sessions, SSO grants, refresh tokens, application-specific entitlements, and any recovery methods that bypass the primary factor. Passwordless changes the authentication ceremony, but the downstream control plane still has to answer the same questions: who owns the identity, what systems does it reach, and what must be revoked immediately when that identity is no longer valid.

The most reliable approach is to treat offboarding as a workflow with technical triggers, not a manual checklist. Best practice is evolving toward tightly coupled identity lifecycle controls, where HR status, contractor end dates, and service ticket closure automatically initiate revocation across IdP, SaaS, cloud, and privileged access layers. NHI Management Group’s NHI Lifecycle Management Guide and the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs both emphasise that lifecycle governance only works when inventory, ownership, rotation, and offboarding are connected.

• Revoke active sessions and refresh tokens first, not just the primary login method.
• Remove group membership, app roles, and delegated admin grants in the same workflow.
• Disable recovery channels that can recreate access after offboarding.
• Verify revocation against cloud consoles, SaaS tenants, and PAM systems.
• Log completion evidence so access review and audit teams can confirm closure.

For high-risk roles, deprovisioning should also include device trust removal and certificate invalidation, because passwordless often relies on trusted devices or cryptographic credentials that outlive the user unless explicitly revoked. These controls tend to break down when identity stores are fragmented across multiple business units because ownership, timing, and revocation order are inconsistent.

Common Variations and Edge Cases

Tighter deprovisioning often increases operational overhead, requiring organisations to balance speed of revocation against the risk of accidental disruption to active work. That tradeoff is real, especially in environments with shared accounts, temporary contractors, break-glass access, or federated SaaS apps with weak lifecycle hooks. Current guidance suggests that the more distributed the identity estate, the more aggressively offboarding has to be automated.

Edge cases usually appear where passwordless is implemented unevenly. If one platform uses FIDO2 passkeys, another uses device certificates, and a third still relies on long-lived API tokens, the organisation can end up with three different offboarding standards for the same person. The risk is even higher when privileged access is involved, because a passwordless login can still lead to broad application access through cached sessions or dormant entitlements. The NHI control perspective from Top 10 NHI Issues is useful here: lifecycle failure is often less about the factor and more about stale access that was never fully removed.

For shared devices, kiosk accounts, and emergency access, there is no universal standard for this yet beyond strong local policy, immediate session revocation, and periodic recovery testing. Security teams should assume that any passwordless deployment still needs a complete deprovisioning path, because eliminating passwords does not eliminate residual trust.

Related resources from NHI Mgmt Group

• Why does passwordless authentication still require strong IAM governance?
• What is the difference between rotation and deprovisioning for NHIs?
• Why do passwordless logins still need strong access controls?
• Why does passwordless authentication still need MFA and session controls?