5 Passkey Rollout Lessons Every Identity Team Should Know

Summary of key technological lessons for Passkey rollouts (identity/workforce)

Passkey complexity shifts to the client/front-end

Unlike SMS/OTP (where the backend sends codes), passkeys rely heavily on browser + OS + credential manager support and correct client behavior.

Major failure causes tend to be client-side, including:

• unsupported browser/OS versions
• credential manager bugs
• sync issues
• device capability gaps

Company/product context

Vincent Delitz (from Kovado, founded Corbado) works on a Passkey Intelligence platform designed to help large organizations:

• deploy passkeys at scale
• diagnose why adoption is low after launch
• integrate passkeys alongside an IDP (e.g., Entra/Entra ID, Okta, Ping—mentioned examples)

---

“Day 1” (deployment design) guidance

1. Don’t confuse users about login

   • Make passkeys the default and/or highest-priority option where possible, so users don’t have to “think” about which method to use.
   • Keep the rollout flow simple to maximize uptake.

2. Start with the right business motivation Validate core motivations up front, such as:

   • User experience (faster login, potential conversion improvements)
   • Security (phishing resistance, improved security posture, compliance drivers)
   • Cost and support reduction (fewer MFA/password resets; cited ~20–50% fewer resets)

3. Use device readiness signals

   • Before making passkeys default, collect readiness signals such as:
     • browser support
     • API availability
     • credential manager presence

---

“Day 2” (operations after launch) problems

• Flat adoption despite rollout

  • Enabling passkeys as an optional method often produces low usage because users are trained for passwords/older MFA patterns.

• Edge cases appear in production

  • Unpredictable platform changes (e.g., iOS/Chrome backend/API issues) can break passkey flows in ways that can’t be fully tested in advance.

• The business case may not materialize

  • Even if dashboards show high “signing success,” real login success can be lower due to client-side issues not captured fully.

• Cross-device passkey authentication can fail

  • The QR-based cross-device flow uses a connectivity tunnel (via Apple/Google services and Bluetooth proximity checks). Some networks block it.

• MDM/managed device settings can disable features

  • Managed environments may disable sync/passkey capabilities by default or restrict needed functionality.

---

Key operational/metrics insight: “success rate” dashboards can lie

Admin/back-end metrics can report 95%+ “signing success rate”, but actual user success might be much lower (they mention cases as low as ~40%).

Why dashboards can overstate success:

• the backend may count success/attempts around the challenge flow without capturing user intent or earlier aborted UI steps
• the passkey might not be present on the current device (sync/version differences)
• credential manager and autofill behavior differs across devices

---

Adoption strategy: phased transition toward passwordless

A recommended staged approach:

1. Add passkeys as an additional method (don’t remove passwords immediately)
2. Nudge adoption (make it default; encourage usage)
3. After sustained passkey-only usage by some users, remove phishing/vulnerable methods for that cohort
4. Address recovery last—recovery is often the weakest link and may still require helpdesk assistance

Important caution: don’t disable passwords on day one, or support volume may spike due to confusion and inability to recover.

---

Multi-passkey support

• Allow users to create multiple passkeys across devices.
• Restricting to one stored device can break logins when passkeys don’t sync across that user’s devices.

---

Terminology & internal communication

Avoid confusion between:

• passkeys vs security keys vs Windows Hello / Touch ID / credential managers
• older terms such as FIDO/passwordless naming changes

Clear communication helps reduce rollout friction.

---

Attestation vs sync passkeys (workforce security trade-off)

• Attestation

  • Provides cryptographic assurance about the authenticator/device model during registration.
  • Works best with device-bound physical security keys (e.g., UBKeys).

• Sync passkeys

  • Examples: iCloud Keychain, Google password manager, Bitwarden, etc.
  • Generally cannot support attestation enforcement, because synced credentials can be used across multiple authenticators/devices.

Practical compromise:

• enforce attestation for high-privilege/admin cohorts
• relax attestation enforcement for broader staff to allow synced passkeys

AAGUID explanation (Authenticator Attestation GUID)

• AAGUID is an identifier emitted by authenticators to improve user experience (helps identify credential source).
• It’s more meaningful when attestation is enforced; it’s less reliable for synced passkeys since users can’t be constrained to a single authenticator type.

---

Support/telemetry and troubleshooting recommendations

• Maintain a database/mapping of:

  • OS + browser + credential manager combinations that fail
  • known issues per platform version (e.g., specific iOS failures)

• Use front-end instrumentation or browser APIs where possible to detect:

  • support capability
  • where in the ceremony the failure occurs (abort vs error vs misconfiguration)

• Diagnose “cannot log in” scenarios, often caused by:

  • passkey not present on that device
  • wrong default credential manager
  • missing Bluetooth/network capability for cross-device flow

• Note: passkey UX can be affected by third-party password managers in the organization

  • these may “hijack” browser integration and alter the flow.

---

Planning readiness for kiosk / third-party sign-in contexts

Validate environmental dependencies:

• If relying on Bluetooth, ensure kiosks/devices allow it.
• Verify NFC availability if relying on NFC rather than Bluetooth.

They cite an example where kiosk hardware had Bluetooth disabled, breaking passkey flows.

---

Main speakers / sources

• Vincent Delitz — Managing Director/Founder at Kovado (previously founded Corbado); passkey intelligence and large-scale passkey deployment experience.
• Host: “Merrill” — interviewer for Entra Chat (name appears as “Merrill” in the transcript).