Video summary

The Enterprise Passkey Playbook: 200,000 People at General Motors

Main summary

Key takeaways

Technology

Technological concepts & strategies discussed (Entra + Passkeys at GM)

Passkeys as part of a broader identity modernization

  • Andrew frames passkeys as one critical element in GM’s long-running shift toward stronger, phishing-resistant authentication using Entra ID / Azure AD.
  • GM built an identity discipline over time:
    1. Early SSO enablement
    2. Later SAML/OpenID Connect standardization
    3. Deep adoption of Azure AD/Entra starting around 2013

Scale and user/persona model at General Motors

  • GM has ~200,000 employees across ~50 manufacturing plants.
  • Two major “worlds”:
    1. Information workers / corporate users: sign in from devices/browsers (global workforce portion)
    2. Manufacturing environments: separate local Active Directory tied to robots/industrial systems, where mobile phones and standard UI/OTP flows are often unavailable

Strong authenticator mandate for employees (progressive rollout)

  • GM’s strategy is to reduce reliance on weak MFA methods such as SMS and OTP.
  • They set up a core “employee persona” configuration emphasizing passkey enablement:
    • Device-bound passkeys (primary starting point)
    • Synced passkeys later (as policy capabilities matured)
  • Approximately 100,000 employees were primarily enabled via Windows Hello, which was made a mandatory device configuration (PIN + registration), turning devices into passkey-capable authenticators.

Conditional Access (CA) as the enforcement lever

  • After enabling passkeys, GM uses Conditional Access policies to:
    • Require only strong authentication methods (passkey-based)
    • Disable weaker methods (SMS/OTP) once passkey availability is verified
  • They emphasize CA targeting to avoid “big bang” risk:
    • Pilot/security cohorts first, then expand

Handling manufacturing plants (non-phone, non-keyboard realities)

  • In factories, phones are often impractical, so GM developed custom non-password/non-OTP methods to replace password or OTP workflows for safe productivity.
  • Where mobile authentication isn’t possible, authentication is adapted to operational constraints (e.g., robots, gloves, limited input).

Deprecation of SMS/voice and readiness

Motivation for SMS/voice deprecation

  • Andrew says GM was pleased by Microsoft’s plan to deprecate SMS and voice (subtitle references February), since GM was already moving away from weak methods.
  • GM had already:
    • Removed email as an MFA method
    • Enabled passkeys for the employee base to reduce dependence on SMS/OTP

Transition considerations (especially B2B/guests)

  • GM still needs to manage transition carefully for guest/external users (B2B):
    • GM has a complex external population (dealers, suppliers, contractors)
    • Guests may need their source tenant to support/enable passkeys; otherwise enforcing passkey-only can block access
  • GM notes CA trust boundaries for external auth:
    • External flows require that claims/assurance of passkey strength can be validated for policy enforcement

Deployment mechanics: communication, monitoring, and testing

Campaign + nudges at sign-in time

  • GM uses user communication and “nudge” flows to prompt users to register passkeys directly during authentication experiences.
  • They compare the approach to in-person MFA onboarding events (a “lobby/carrot and stick” style), and mention targeted rollout in hubs where applicable.

Use of audit mode / visibility before enforcement

  • GM recommends Conditional Access audit mode to measure:
    • Which authentication methods are actually being used
    • Whether stronger methods are available and adopted
  • This reduces the risk of breaking workflows by learning utilization patterns first.

Progressive targeting to reduce risk

  • Two rollout validation patterns mentioned:
    • User cohorts (small set → expand)
    • High-traffic apps (e.g., M365, Slack, Salesforce) to cover large user percentages while controlling blast radius
  • They prefer iterative expansion and time for app teams to remediate issues.

Roadblocks/corner cases GM encountered

  • New starters / onboarding workflows:
    • Old defaults relied on SMS; removing it required replacement validation
  • Phone number changes:
    • SMS-to-new-number bootstrapping problems
  • VDI/Remote Desktop scenarios:
    • Disabling SMS can affect access paths
    • GM uses alternatives such as:
      • Certificate-based authentication (interpreted from “cert off” subtitles)
      • Entra/SSO integration with Azure Virtual Desktop
    • The discussion also notes that Entra supports SSO patterns for AVD.

Passkey type decisions: device-bound vs synced

  • GM began with device-bound passkeys only, then later expanded as the passkey profile evolved to support both device-bound and synced.
  • Initially, GM restricted synced options for security reasons, treating synced passkeys as less strict until:
    • policies matured, and
    • hardware key attestation requirements could be updated/relaxed as needed
  • Subtext learning: start strict for privileged use cases, then broaden to reduce operational friction.

Product/system features explicitly referenced

  • Entra ID / Azure AD
  • Conditional Access (CA)
  • Audit mode
  • Windows Hello
  • Platform SSO on Mac using device biometrics / Secure Enclave concepts
  • Azure AD / Entra integration with VDI (including Azure Virtual Desktop scenarios)
  • Azure PIM (used to force strong authentication for administrative roles via activation)
  • OpenID Connect / SAML standardization (earlier SSO evolution)
  • Hardware keys:
    • Discussed as strong options for securing access to physical assets/robots, with management tradeoffs at scale

Key takeaways / “wisdom” stated

  • Stay diligent and measure continuously: large-scale identity changes always produce “corner cases”; monitoring and visibility are essential.
  • Plan for non-happy-paths: onboarding flows, mobile replacement, VDI, and guest access can all break if SMS/OTP is removed too quickly.
  • Pilot and iterate: use CA targeting + audit mode + small group rollouts before enforcement.
  • Use stronger methods where it matters first: start with privileged roles/resources, then expand.
  • Expect B2B complexity: passkey-only policies for guests depend on what external tenants can provide; communication/partner expectations matter.

Main speakers / sources

  • Andrew Cameron — Distinguished Engineer, Identity and Cyber Security, General Motors (GM)
  • Marilyn — Host (Entra Chat)

Original video