Requirements for integrating passkeys

Password-based authentication poses significant risks: it is vulnerable to phishing attacks, suffers from the use of weak passwords, and is hardly able to meet the growing demands of IT security. Traditional access methods are therefore considered insecure and difficult to scale. Passkeys now offer companies a modern, user-friendly, and significantly more secure approach. Passkeys are based on the FIDO2 standard and enable completely passwordless authentication without sacrificing flexibility or control.

While many platforms and devices now support passkeys, integrating them into existing corporate infrastructures is by no means trivial. Both technical requirements (e.g., device security, authentication interfaces) and organizational and procedural aspects must be taken into account in order to introduce passkeys in a meaningful, secure, and sustainable manner.

The aim of this article is to provide a structured overview of the most important requirements for introducing passkeys in a corporate environment. From the technological basis to system integration and user acceptance, this guide is intended to help those responsible for IT, security, and digitalization make informed decisions and identify and avoid typical stumbling blocks at an early stage.

Technological basics: FIDO2, WebAuthn & authentication services

The integration of passkeys requires a basic understanding of the underlying technologies. Two key components here are FIDO2 and WebAuthn. Both form the technological basis for secure, user-friendly, and phishing-resistant authentication.

FIDO2 – The security standard behind passkeys

FIDO2 is an open authentication standard developed by the FIDO Alliance in collaboration with the World Wide Web Consortium (W3C). It consists of two components:

• CTAP (Client to Authenticator Protocol): Defines the communication between the authentication device (e.g., security key or integrated fingerprint sensor) and the client (e.g., browser or operating system).
• WebAuthn (Web Authentication): A web standard that enables web applications to implement passkey-based authentication directly in the browser without additional plugins.

FIDO2 replaces the classic password with an asymmetric key pair:

The private key remains securely on the user's device, while the public key is stored with the service. This largely eliminates classic attack scenarios such as phishing, credential stuffing, or brute force attacks.

WebAuthn – Bridging the gap to web applications

WebAuthn is the technical framework through which passkeys are integrated into web applications. Using JavaScript-based APIs, developers can implement login, registration, or authorization processes directly in the browser with passkeys.

Important features of WebAuthn in a business context:

• Supported by all modern browsers (Chrome, Edge, Firefox, Safari)
• Cross-platform use (Windows, macOS, Android, iOS)
• Option to define policies, e.g., which authenticators are permitted (biometric, PIN, security key)
• Use for both single-factor and multi-factor authentication

For companies, this means that an existing web application can be made passkey-enabled with relatively little effort, provided that the backend infrastructure and authentication server support this.

Authentication server – the backbone of integration

For passkeys to function securely and scalably within a company, a suitable authentication server is required. This server manages the public keys, orchestrates the authentication flows, and ideally integrates seamlessly into existing identity and access systems.

Examples of established solutions in the enterprise environment:

• Microsoft Entra ID (formerly Azure AD): Supports passwordless logins via Windows Hello, FIDO2 security keys, and mobile devices with passkey functionality.
Auth0 (part of Okta): Offers comprehensive passkey support with WebAuthn integration and easy API integration.
• MyID CMS (Intercede): Particularly suitable for high-security environments with stringent requirements for identity verification and device binding.

These services not only handle authentication, but often also manage user identities, device binding, recovery scenarios, and auditing.

Device requirements & platform compatibility

The technical feasibility and acceptance of passkey integration depends entirely on the compatibility of the end devices and platforms used. Modern authentication with passkeys is based on local security elements such as TPM (Trusted Platform Module) chips or Secure Enclaves and therefore requires certain minimum hardware and software environment requirements.

Platform support: Broad base – with differences in the details

All major operating systems and platform providers have now integrated support for passkeys or FIDO2/WebAuthn. However, the specific implementations, management options, and cross-device functions differ:

• Windows 11:
  Support via Windows Hello in combination with Azure AD or Hybrid Join. Compatible devices with TPM 2.0 (short for Trusted Platform Module 2.0) and activated Windows Hello PIN or biometric login are required.
• macOS / iOS (from version 16):
  Passkeys are stored directly in the iCloud keychain infrastructure and synchronized with Apple devices. Face ID or Touch ID serve as authentication mechanisms.
• Android (version 9 and higher):
  Passkeys are managed via Google Password Manager and synchronized across platforms via the Google account. Authentication is performed via device lock (PIN, pattern, biometrics).
• Linux:
  Supports passkeys in combination with WebAuthn-enabled browsers and external authenticators (e.g., YubiKey). Additional middleware is required for enterprise-wide use, as Linux lacks the seamless, operating system-wide link between hardware authenticators, user management, browsers, and central IT infrastructures.

Note: Cross-platform use of passkeys is possible in principle, but requires cloud-based synchronization services (e.g., iCloud, Google Sync) or hardware-based solutions such as security keys.

Requirements for workplace devices

To use passkeys as a platform authenticator, the device must have certain security features. Key requirements include:

• Hardware security components:
• TPM (Trusted Platform Module) for Windows devices
• Secure Enclave for Apple devices
• Android Keystore on compatible smartphones
• Authentication mechanisms:
• Biometric sensors (fingerprint, facial recognition)
• PIN-based login (as a fallback and second factor)
• Current operating system & security patches: Outdated operating system versions or missing updates can lead to incompatibilities and security risks.

For IT departments, this means that they need to carry out a device compatibility check and, if necessary, gradually replace older end devices or retrofit them with external authenticators.

Evaluation guide for selecting the appropriate authenticator type

Enterprise infrastructure & system integration

Simply supporting passkeys in devices and applications is only part of the challenge. Comprehensive integration into the existing IT infrastructure is crucial for sustainable and secure implementation in the enterprise. Identity and access management (IAM) is particularly important here. Aspects such as compatibility, scalability, and governance must be carefully planned and implemented.

Central identity management as a key component

Functional identity and access management (IAM) is a prerequisite for the effective use and management of passkeys in the enterprise. IAM systems form the bridge between users, applications, and authentication technologies.

Typical requirements for IAM systems for passkey integration:

• FIDO2/WebAuthn support:

Ability to register and manage passwordless login methods

Device binding & registration: Traceability, management of multiple devices per user

Role- and policy-based access control: Integration of passkeys into existing policies

Self-service functions: User-friendly management, recovery options, device change

Table with examples of supported IAM platforms:

SoftGuide template for an integration checklist: Passkey introduction into existing infrastructure available for download

Selecting the appropriate passkey integration model

Passkeys can be used in different integration models. The choice of model depends on the type of application, the target group, and the desired level of security.

Table with integration models

A consistent login experience across all devices significantly increases acceptance, especially when users can utilize familiar elements such as biometric login or smartphones.

Security aspects & operational reliability

The introduction of passkeys brings a significant increase in authentication security when designed with recovery strategies, platform changes, and compatibility with existing procedures in mind. A systematic look at security mechanisms, backup solutions, and interoperability is crucial for stability and long-term usability in a corporate context.

Backup and recovery processes

Passwordless login using passkeys is based on asymmetric cryptography, where the private key remains stored on the device. If this device is lost or replaced, it must be ensured that access is not permanently blocked.

Table with important backup strategies in the corporate environment

Conclusion

The integration of passkeys marks an important milestone on the path to modern, user-friendly, and secure authentication in the corporate environment. Not only does it solve the password problem, but FIDO2 and WebAuthn also offer a technologically robust, phishing-resistant standard that is already available across platforms today.

However, for this technology to reach its full potential, a number of prerequisites must be met, both at the technical level (e.g., device security, protocol support, authentication server) and at the organizational level (e.g., migration strategy, training, IAM connection).

Passkeys are not an isolated technology, but part of a strategic shift in identity management. When implemented correctly, they not only strengthen IT security, but also improve the user experience and reduce administrative overhead in the company in the long term.

Further information and downloads:

• SoftGuide checklists:
• Is my company ready for passkeys?
• Device checklist: Requirements for using passkeys
• Integration checklist: Introducing passkeys into existing infrastructure
• SoftGuide article:
• Advantages of passkeys over traditional passwords
• Security of passkeys

• FIDO Alliance https://fidoalliance.org/
• Glossary of passkeys, instructions, and UI kits https://www.passkeycentral.org/resources-and-tools/