Security
Notes on rolling out passkeys to a workforce
Phishing-resistant sign-in is finally practical for ordinary staff. What goes smoothly, and what needs planning.
We moved our own staff to passkeys and hardware keys this year and have planned the same rollout for agency environments. Most of it is easier than expected. A few parts need thought.
What goes smoothly
Enrollment on managed laptops and phones takes a minute. Staff prefer touching a fingerprint sensor to typing codes. Sign-in gets faster, not slower, which is unusual for a security change.
What needs planning
Recovery. When a device is lost, the fallback must not be a phishable code sent by text. We use a second registered passkey or a hardware key held by the person, plus an identity-verified help desk process for the rare case where both are gone.
Shared and field devices. A dispatch console used by several people, a tablet in a truck. These need hardware keys, badge-based sign-in, or device-bound solutions designed per use case.
Legacy applications. Systems that only understand passwords need single sign-on placed in front of them, or they stay as an exception with compensating controls and a replacement date.
Personal devices. Passkeys sync through the platform's account. Decide whether that is acceptable for agency accounts on personal phones, or require managed devices.
Administrators first. Privileged accounts move to hardware keys before anyone else, and password fallback is removed for them.
What to tell staff
That this replaces codes, that it is faster, that it protects them from the convincing fake login pages they will inevitably receive, and exactly what to do if they lose a device.
For agencies
This is the single highest-impact security change most agencies can make this year, and the identity platforms they already license support it. It is a project of weeks, not years.