Passkey rollouts stall less on technology than on people who do not know what a passkey is, why they are being asked to create one, or whether the email asking them to is genuine. Workforce communications have a security job as well as an adoption job: every enrolment email is a template an attacker can copy, and every help desk call about a lost device is a chance to register an attacker's authenticator. This pack gives [Organisation] ready-to-adapt emails, an intranet FAQ and help desk scripts for a staff passkey rollout, written so that they teach the right habits rather than undermine them. It is for identity programme leads, internal communications teams and service desk managers. For the rollout plan itself (populations, phasing, synced or device-bound passkeys) see the Passkey Rollout Guide.
How to use this template
- Bracketed timings, durations and thresholds are NHI Mgmt Group recommendations; adjust them to your risk appetite, policies and contracts.
- Replace the bracketed values: [Organisation], [enrolment page], [help desk number], [go-live date], [password removal date] and the device types you support. Keep the enrolment page as a short internal address people can type, not only a link.
- Keep the security rules in section 2 in every message. They are what stops the campaign becoming a phishing template.
- Send from one known sender (for example the IT service account your staff already recognise), announce that sender on the intranet first, and never include a link that leads to a sign-in page outside your identity provider.
- Use the word "passkey" consistently. The FIDO Alliance design principles and Google's passkey UX guidance both recommend naming passkeys explicitly and linking them to familiar ideas such as unlocking your phone.
- Pair the pack with the procedure. The help desk scripts in section 8 assume [Organisation] has a written identity verification procedure. See the Help Desk Identity Verification Policy Template.
1. Audiences and message calendar
1.1 Tailor the campaign by population. Administrators and other high-risk roles usually enrol first and may be issued device-bound passkeys on hardware security keys; general staff often use synced passkeys on managed devices.
| When | Message | Audience | Channel |
|---|---|---|---|
| Go-live minus [4] weeks | Manager briefing (section 3) | People managers, help desk, site IT | Briefing pack, team meeting |
| Go-live minus [2] weeks | Announcement (section 4) | Wave population | Email from known sender, intranet news |
| Go-live | Enrol now (section 5) | Wave population | Email, sign-in prompt in the identity provider |
| Go-live plus [7] and [14] days | Reminder (section 6) | Not yet enrolled | Email, manager nudge |
| Password removal minus [14] days | Password removal notice (section 7) | Enrolled users | Email, intranet |
| Throughout | FAQ (section 9), security warning (section 2) | All staff | Intranet page |
2. Security rules for every message
2.1 Every message in this pack must state, in plain words:
- Where to enrol: "Only create your passkey at [enrolment page]. Type the address yourself if you are unsure about a link."
- What we will never do: "IT will never ask you for your password, a code from your phone or your recovery details by email, chat or phone, and will never ask you to approve a sign-in you did not start."
- How to check: "If a message about passkeys looks odd, do not click it. Report it with [the report button] or call [help desk number]."
2.2 Messages must not ask users to reply with information, open attachments, or scan a QR code received by email. Cross-device sign-in with a QR code is a normal part of using passkeys on a new computer, but it is started from the sign-in screen the user opened, not from a message.
3. Manager and help desk briefing
Subject: Briefing: passkeys for [Organisation] staff from [go-live date]
From [go-live date], [Organisation] staff in [wave] will sign in with a passkey instead of a password and code. A passkey is a sign-in credential stored on a phone, computer or security key; people unlock it the same way they unlock their device, with a fingerprint, face or PIN. Passkeys cannot be phished or reused on a fake site, which is why we are moving to them.
What we need from you: tell your team the change is coming and that the only place to enrol is [enrolment page]; give people [15] minutes in a team meeting to enrol together; and tell anyone who calls about a lost or new device to use the process at [recovery page], never a colleague's help. Help desk staff: the scripts and verification steps are in [knowledge article].
4. Announcement email
Subject: From [go-live date]: sign in to [Organisation] with a passkey
Hello [first name],
From [go-live date] you will be able to sign in to [Organisation] systems with a passkey. Instead of typing a password and a code, you unlock your device the way you already do, with your fingerprint, face or PIN, and you are in.
Why we are doing this: passwords and codes can be stolen by fake sign-in pages. A passkey only works on [Organisation]'s real sign-in page, so it cannot be tricked into working for a scammer.
Your fingerprint or face never leaves your device. [Organisation] does not receive or store it; your device simply confirms it was you.
You do not need to do anything yet. On [go-live date] we will send a short guide. You will only ever create your passkey at [enrolment page].
IT will never ask you for your password or a code by email, chat or phone. If anything about this message looks wrong, report it with [report button].
[Programme name], [Organisation] IT
5. Enrol now email
Subject: Create your [Organisation] passkey (5 minutes)
Hello [first name],
You can now create your passkey. It takes about five minutes.
- On your [work laptop / work phone], open [enrolment page] by typing it into your browser.
- Sign in as usual, then choose Create a passkey.
- When your device asks, confirm with your fingerprint, face or PIN.
- You will see "Passkey created". Next time, choose Sign in with a passkey.
Please create a second passkey on [another work device or the security key we sent you] so you are not locked out if you lose one device. Do not create a passkey on a shared or personal computer [unless your role allows it].
Step-by-step guides with screenshots for [Windows], [macOS], [iOS] and [Android] are at [guide page]. Help: [help desk number].
IT will never ask you for your password or a code by email, chat or phone.
6. Reminder email
Subject: Reminder: your [Organisation] passkey is not set up yet
Hello [first name], our records show you have not yet created a passkey. From [password removal date] passwords will no longer work for [systems]. Create yours now at [enrolment page]; it takes five minutes. If something stopped you, such as an unsupported device or an accessibility need, tell us at [help desk number] and we will arrange an alternative. Drop-in help sessions: [dates and locations].
7. Password removal notice
Subject: From [password removal date], your password will no longer be used for [systems]
Thank you for setting up your passkey. From [password removal date], signing in to [systems] will use your passkey only. Check you have at least two passkeys or a passkey and a security key: see "My sign-in methods" at [enrolment page]. If you lose all your devices, call [help desk number]; we will check your identity before helping you, which may include [video verification with your manager / a visit to the service desk]. Please do not be offended by these checks: they protect your account.
8. Help desk scripts
8.1 The help desk must verify identity before any change to a user's sign-in methods, using the [Organisation] verification procedure. Never register a passkey or issue an enrolment code on the strength of a caller's name, employee number or personal details alone; these are easy to find.
| Call reason | Script and action | Never |
|---|---|---|
| "How do I set up a passkey?" | "I can guide you. Please type [enrolment page] into your browser and sign in as normal." Talk through section 5. No identity check needed: the user signs in themselves. | Ask for their password or code; remote-control their screen to sign in for them |
| Device does not offer passkeys | Check the device against the supported list. "Your device is not on our supported list. I will log a request for [a security key / a device update] and confirm the alternative for now." | Disable MFA for the user; enrol a passkey on your own device |
| Lost or replaced device, still has another passkey | "Please sign in with your other passkey at [enrolment page], remove the lost device under My sign-in methods and add the new one." Log the lost device for asset tracking. | Delete all methods and start again |
| Lost all devices (full recovery) | "For your protection I need to verify your identity using [method]." Complete verification, then issue a single-use, time-limited enrolment code [valid for [8] hours] delivered through [an approved channel]. Notify the user's manager. | Send the code to a new phone number or personal email supplied on the call |
| Caller pressing for urgency, claiming seniority, or asking to add a new phone | "I understand this is urgent. Our process is the same for everyone. I will call you back on the number in our directory." Escalate to [security on-call] if pressure continues. | Skip verification; add an authenticator on request |
| "I got an email asking me to set up a passkey and I'm not sure it's real" | "Thank you for checking. Please do not click it. Report it with [report button]; the only place to enrol is [enrolment page]." | Confirm a link is genuine without seeing it |
8.2 Every change to sign-in methods made by the help desk is logged with the ticket number and reviewed by [security operations] daily. See the Account Recovery and Help Desk Security Guide and the Passkey account recovery guide.
9. Intranet FAQ
- What is a passkey? A sign-in credential stored on your phone, computer or security key, unlocked with your fingerprint, face or PIN. The FIDO Alliance describes passkeys as based on FIDO standards and resistant to phishing.
- Does [Organisation] get my fingerprint? No. Your fingerprint or face is checked on your device and never sent to us. We only receive confirmation that the check worked.
- Do I need a fingerprint reader? No. Your device PIN or screen lock works too.
- Why is it safer than a password and code? A passkey only works on [Organisation]'s real sign-in page, so a fake page cannot capture anything reusable. There is no password for anyone to steal or guess.
- What if I lose my phone? Use your second passkey or security key, then remove the lost device at [enrolment page]. If you have lost everything, call [help desk number].
- Can I sign in on a computer that does not have my passkey? Yes, the sign-in screen can show a QR code that you scan with your phone, which must be nearby. Only do this on a sign-in screen you opened yourself.
- Can I use my personal phone? [Yes, for synced passkeys stored in your phone's password manager / No, only managed devices or the security key we issue.]
- Will my passkey sync to my other devices? [Explain your policy: synced passkeys are copied across your devices by your passkey provider with end-to-end encryption; device-bound passkeys and security keys stay on one device.]
- I have an accessibility need. Contact [help desk number]. We support [security keys, PIN-only unlock and other options].
- How do I know a passkey message is genuine? We only ask you to enrol at [enrolment page], and we never ask for your password or a code.
Implementation guidance
- Test the messages with a pilot group of [50] users across device types, and record where they get stuck; adjust the wording and guides before wave 1.
- Brief the service desk first and run two or three role-played full-recovery calls, including a pressured caller, before go-live.
- Warn the phishing-simulation team. Pause passkey-themed simulations during the live campaign, then use them afterwards to check that staff report fake enrolment emails.
- Measure: enrolment rate per wave, share of users with two or more passkeys, help desk contacts per 100 enrolled users, full-recovery requests, reported suspicious passkey emails, and password sign-ins remaining after the removal date.
- Roll back by population, not message. If a wave hits blocking device issues, delay its password removal date and send a short correction email; do not reissue passwords by email.
- Map for audit. NIST SP 800-53 Rev. 5 AT-2 Literacy Training and Awareness and IA-5 Authenticator Management; NIST CSF 2.0 PR.AA-03.
Common failure patterns to avoid: enrolment emails that link straight to a sign-in page, so a copy looks identical; inconsistent names ("security key", "FIDO login", "passwordless token") for the same thing; recovery advice that tells users to "call and we will reset it" with no verification step; and announcing a password removal date before the help desk and device estate are ready.
Related NHI Mgmt Group resources: Passkey Rollout Guide · Passwordless and Passkeys Guide · Top 10 Passkey Deployment Mistakes · Vishing and Help Desk Social Engineering Awareness Guide