What password manager or app are you using to deploy and manage synced passkeys? Microsoft Authenticator passkeys appear to be device-bound, which seems like it could make replacing devices or signing in from multiple devices more difficult. I'm interested in how others balance convenience with the security benefits of device-bound credentials.
3 Answers
We avoid syncing passkeys because portability removes part of their security model. Passkeys are intended to be device-bound, so making them transferable is convenient but could also make them easier for an attacker to obtain. Password managers can provide cross-device access, but that’s a trade-off worth evaluating carefully.
We enabled synced passkeys in Entra and have employees store their Microsoft passkeys—and other passkeys—in 1Password. It has worked well for keeping credentials available across approved devices.
RoboForm has worked well for us. It detects passkeys when they’re created and syncs them across devices. We also use shared company vault folders so employees can access passkeys for organizational accounts when appropriate.
That makes sense. I was initially thinking about this from a password-and-MFA perspective, but having multiple passkeys registered on different devices may be a better approach. A compromised or retired public key can also be removed from Entra.