We're getting started later than we'd like with passkey adoption, and our Salesforce team says passkeys will soon be required for users with privileged access. I'm trying to figure out the best way to manage them. Some users appear to be creating and storing passkeys through Chrome or the associated Google password manager, which makes me uncomfortable from a security and offboarding perspective. Are you blocking browser-based passkey storage, using an enterprise password manager such as 1Password, Bitwarden, or Keeper, or requiring device-bound credentials through something like Microsoft Authenticator or YubiKeys? I'd especially like to hear how you handle separation between work and personal devices, recovery, and employee offboarding.
6 Answers
Keeper is another option if you need a more enterprise-focused platform. It supports administrative controls, offline access, break-glass scenarios, and transferring passkeys between users. It can be expensive, but those features may justify the cost for organizations with strict compliance or recovery requirements. 1Password is also a reasonable choice if its controls fit your environment.
Be careful with the terminology here. Passkeys saved through Chrome are generally being stored by the underlying Google Password Manager, not just in a local browser cache. That storage is tied to the user’s Google account and synchronization settings, so you should verify exactly what your identity provider and browser policies allow before deciding whether it meets your organization’s requirements.
YubiKeys are worth considering for privileged accounts, assuming Salesforce supports the authentication method you need. They cost more and require inventory and replacement procedures, but the credentials stay on a physical token instead of being mixed with a user’s personal devices or browser profile. They also make offboarding straightforward because the token can be collected or disabled, and the user experience is usually just touching the key.
An enterprise password manager is probably the most practical option. 1Password, Bitwarden, and Keeper can centrally manage passkeys, support recovery workflows, and make offboarding easier. I’d define an approved storage location and discourage users from saving work credentials in whichever browser or personal password manager happens to be on their device.
That’s the direction I’m leaning too. I’m still trying to determine how to prevent users from creating or storing the same passkeys somewhere outside the approved manager.
A combination can work well: use Bitwarden company-wide for general passkey management, then require YubiKeys for administrators or other high-risk accounts. That gives most users a manageable experience while keeping the most sensitive credentials on hardware-backed devices.
Before choosing a product, establish a policy for where privileged passkeys may live, whether synchronization is allowed, how backup credentials are handled, and what happens during device loss or employee termination. For the highest-risk roles, hardware-bound credentials are usually easier to reason about than allowing passkeys to follow a personal browser or cloud account.
Right, and that Google-account relationship is the part I’m concerned about. It could make ownership, recovery, and separation between personal and company use difficult.