We're rolling out passkeys as part of Microsoft's move away from SMS and voice authentication, but we're running into problems with where users save them. Some employees use LastPass or Bitwarden browser extensions, while others rely on Google Password Manager or Edge's built-in manager. When a passkey is saved in the browser instead of Windows Hello, Teams and Outlook often can't access it because they use the native Windows security and WebAuthn APIs rather than the browser extension. We also have employees with basic flip phones who don't want to carry a physical security key. Windows Hello works, but many users get confused during enrollment and end up saving the passkey in their browser instead. What setup or policy works best for managing this consistently?
4 Answers
The flip-phone and physical-key objections are primarily policy and operational decisions, not something a passkey configuration can solve. If an account requires phishing-resistant authentication, the organization needs to define an approved method—such as Windows Hello, a hardware security key, or an appropriately supported third-party provider—and make that requirement clear. For shared or limited-use devices, consider whether those users need individual accounts or whether a different access model is appropriate.
Bitwarden and LastPass may offer options to let the operating system handle passkeys or to control whether their extensions respond to Microsoft sign-in pages. Those settings can help, but support varies by product release and some features may still be experimental. If you use a third-party provider, test it on the exact Windows, browser, and application versions you manage, and decide whether synced passkeys meet your organization’s security requirements.
That makes sense. We’ll need to test the OS integration instead of assuming that a browser extension will work everywhere.
Native Windows applications such as Outlook and Teams generally use the Windows Hello/WebAuthn platform integration, not whatever passkey provider is available inside a browser. Unless the password manager supports OS-level passkey integration on that device and version, a passkey stored only in a browser extension usually won’t appear in the native app’s sign-in prompt. Standardizing on Windows Hello for assigned Windows devices is likely the least confusing approach. Check your password manager’s current support for Windows passkey-provider integration before depending on it.
For company-managed Windows laptops, I’d make Windows Hello the standard enrollment path and remove the choice between several passkey locations wherever possible. Provide a short, repeatable setup guide and confirm enrollment before users need to sign in. If Outlook and Teams are repeatedly requesting MFA on compliant devices, also review Entra policies, device registration, and Conditional Access, since frequent prompts can indicate a configuration issue.
Exactly. If users are not willing or able to use any approved authenticator, management needs to decide whether to provide one, change the workflow, or accept that the account cannot meet the required security standard.