We plan to require privileged administrators to use device-bound passkeys, but we are considering synced passkeys for standard users because some Android versions do not reliably support device-bound passkeys. Requiring everyone to use Android 15 or newer is not practical.
Synced passkeys would also let users who currently use SMS MFA avoid installing a dedicated work app on their personal phones. They can use the password managers already built into iOS and Android, or another compatible password manager they already trust.
The concern is that synced passkeys inherit the security and account-recovery protections of the user's Apple, Google, or third-party password-manager account. Microsoft Authenticator work credentials, by comparison, are not automatically synced to every device where the user signs in.
For Microsoft Entra sign-in, is allowing synced passkeys a greater security risk than requiring a password plus MFA through an authenticator app?
3 Answers
I would still be cautious about treating synced passkeys as equivalent to device-bound credentials for sensitive enterprise access. You may not know how a user protects their personal cloud account, what recovery methods are enabled, or which devices can access the synced credential.
For privileged access, device-bound passkeys or hardware security keys are a better fit. For ordinary users, though, synced passkeys may still be safer than keeping passwords and OTP-based MFA as the fallback.
A synced passkey is still a phishing-resistant, origin-bound WebAuthn credential. Compared with passwords plus SMS, TOTP, or push-based authenticator MFA, it is generally a significant improvement because it is much harder to relay or steal during a phishing attack.
The main tradeoff is not that the passkey suddenly becomes a weak credential. It is that its trust and recovery process now depend on the user’s Apple, Google, or third-party password-manager account. For that reason, using device-bound credentials for privileged administrators while allowing synced passkeys for standard users is a reasonable risk-based approach.
If you allow synced passkeys, add other access controls rather than relying on the passkey alone for high-impact systems. Device trust, certificate-based controls, conditional access, network restrictions, and separate administrative accounts can reduce the consequences of a compromised personal account or recovery process.
For infrastructure and privileged administration, hardware security keys such as FIDO2 keys are worth considering. Synced passkeys in isolation should not be treated as equally strong as device-bound credentials, even though they are generally more phishing-resistant than passwords plus authenticator codes.
Agreed that device-bound passkeys or security keys are the strongest option for administrators. The proposed use of synced passkeys would be limited to standard users who otherwise would continue using passwords with authenticator-based MFA.
That is the comparison I am trying to make. Device-bound passkeys are clearly preferable, but the practical alternative for many standard users is still a password combined with Microsoft Authenticator MFA or SMS. The question is whether synced passkeys improve that situation despite their cloud-sync and recovery risks.