We're getting started with passkeys later than I'd like, and our Salesforce team says passkeys will be required for users with privileged access. I'm trying to figure out the best management approach. Some users appear to be creating and storing passkeys through Chrome or the associated Google password manager, which raises concerns about portability, account ownership, offboarding, recovery, and mixing personal and work credentials. Are you restricting browser-based passkey storage? Are you using an enterprise password manager such as 1Password, Bitwarden, or Keeper, or keeping passkeys device-bound through hardware security keys or Microsoft Authenticator?
4 Answers
Keep in mind that passkeys saved through Chrome are generally being handled by the underlying platform or synced password manager, not just sitting in a local browser folder. That still means the credential may be tied to a Google or other personal account, so you should verify exactly where synchronization occurs and whether it is covered by your organization’s policies. Managed profiles and explicit restrictions are important if browser storage is not approved.
A hybrid model makes sense: use managed password-manager passkeys for normal users, while requiring hardware-backed, device-bound credentials for administrators and other high-risk roles. Microsoft Authenticator or platform-bound credentials may also work if your identity policies and Salesforce integration support them. I wouldn’t rely on an unmanaged browser profile for privileged access.
A company-managed password manager is probably the most practical option. 1Password, Bitwarden, and Keeper can all provide centralized administration, recovery controls, and better visibility than letting everyone use whatever browser storage happens to be available. The main thing is to define ownership, offboarding, break-glass access, and whether passkeys may be moved between devices.
That’s the direction I’m leaning too. I’m especially interested in preventing users from creating unmanaged copies elsewhere.
For highly privileged accounts, I’d strongly consider physical security keys such as YubiKeys if Salesforce supports the required authentication flow. They cost more and need an inventory and replacement process, but they keep the credential separate from personal devices and make offboarding straightforward. Users also tend to accept them well when the sign-in experience is just inserting or tapping a key.
The separation between work and home credentials is a big advantage. You can issue the key, recover it when someone leaves, and avoid relying on a user’s personal password manager or cloud account.
That distinction helps, but the dependency on a personal or uncontrolled cloud identity is still what worries me. We’ll need to confirm the storage and sync behavior before allowing it.