Start with the day a device is unavailable
Imagine an operations manager losing a phone while travelling, just before an important customer update. This hypothetical situation turns a sign-in improvement into an access and support question. Before introducing passkeys to a business application, decide how an authorised person would regain access, who would help and which evidence the support team would require. Include recovery in the rollout scope from the beginning.
Understand where the credential can be used
FIDO Alliance distinguishes device-bound passkeys, which require the original registered device, from synced passkeys that may be available across devices through a passkey provider account. Those choices have different management and recovery implications. Separately, NIST describes WebAuthn as providing phishing resistance through binding authentication to the verifier’s domain. Our recommendation is to assess the complete sign-in and recovery journey, rather than treating the passkey label as a guarantee about every account process. FIDO Alliance: High Assurance Enterprise FIDO Authentication. NIST SP 800-63B-4: Phishing resistance.
Arrange another approved route before it is needed
NIST recommends encouraging users to maintain at least two separate means of authentication to reduce the need for account recovery. For a proposed deployment, confirm which alternatives the application actually supports and whether they remain available when the main device is lost. Consider dependencies on the same phone, provider account or administrator. Give users clear enrolment instructions, and verify that the alternative meets the organisation’s access policy. NIST SP 800-63B-4: Authenticator event management.
Define recovery as a controlled account change
Document how the service checks a recovery request, adds a replacement authenticator and handles a credential reported lost or compromised. NIST’s recovery guidance includes notifying the account holder, helping them detect an unauthorised recovery. Our suggested design gives users a clear way to report unexpected changes and gives support staff an escalation path. Review the actual identity provider’s capabilities and the sensitivity of the application before choosing the process. NIST SP 800-63B-4: Authenticator event management.
Pilot loss, replacement and departure
Use test accounts to rehearse a new device, an unavailable primary device, loss of every approved authenticator and an employee leaving. Confirm the intended access outcome, notifications and support records for each case. Include the people who operate the help desk and the business workflow. Track successful sign-ins, incomplete enrolments, recovery completion time and unresolved cases. Expand the rollout when the agreed evidence supports it, with a named owner for ongoing access management.