Should I Use Microsoft Authenticator Passkeys for Emergency Access Accounts Instead of Yubikeys?

I would strongly recommend sticking with hardware tokens like Yubikeys. They're less likely to be compromised over time compared to a phone, which might be lost or hacked. It's essential to have those tokens well managed, maybe assigning a couple of senior folks as key holders while ensuring they know how to set them up remotely. Plus, you can easily track who has access to them, which is harder to do with personal devices.

In theory, using passkeys via the Microsoft Authenticator app might seem convenient, but remember that emergency access accounts are meant to be strictly controlled. Relying on admins' personal devices could increase security risks, especially if their phones get compromised. It's usually safer to have hardware tokens locked away, preferably in a place where only a few trusted people can access them. This way, you ensure the access is only used in critical situations and not just because it’s convenient.

While having emergency access accounts readily available is crucial, they also need to be hard to access. Using passkeys tied to personal phones goes against that principle. What if an admin leaves, or their phone is lost? Every change in personnel complicates things. The best approach, as mentioned, is to have a handful of hardware tokens stored securely that are only used when absolutely necessary. That keeps the account's integrity intact.

Emergency access accounts should be on lockdown, and hardware keys are ideal for this purpose. They can be stored strategically, like in a safe that multiple trusted individuals have access to. This ensures that even if something happens to one person, others can still retrieve the key. Just be sure to check the tokens regularly to confirm that they still work! Overall, having multiple hardware tokens is a lot safer than limiting access to personal phones.