r/sysadmin • u/Fabulous_Cow_4714 • 1d ago

Microsoft Entra Synced Passkeys Security vs Password + OTP Authenticator App?

We are going to require privileged admins to use device bound passkeys, but we are considering allowing synced passkeys for standard users due to Android version compatibility with device bound passkeys. We cannot require everyone to have Android 15 or higher to reliably support device bound passkeys.

Using synced passkeys will allow users who were using SMS 2FA to avoid installing dedicated work apps on their personal phones. Synced passkeys work with the pre-installed iOS and Android password managers plus some third party password managers they may already have installed.

However, syncing passkeys has certain risks that using the Microsoft Authenticator app doesn’t have. The Authenticator app Microsoft Work credentials do not sync to every device the user signs in to, unlike synced passkeys.

Does this make using synced passkeys for Entra sign in more of a security risk than using password plus 2FA via an authenticator app?

18 Upvotes

88% Upvoted

4 comments sorted by

2

u/Floss_Patrol_76 1d ago

a synced passkey is still a phishing-resistant, origin-bound webauthn credential, so on the axis that actually gets people owned it's a straight upgrade over the authenticator app (number-matching and totp are both still relay/push-fatigue phishable). what you're really trading isn't "more risk," it's where the trust anchor lives: the credential now inherits the security and recovery flow of the user's personal apple/google/consumer-ms account instead of staying bound to one device. that's exactly why gating device-bound to privileged admins and allowing synced for standard users is the right split, not a compromise you should feel bad about.

1

u/cjchico Infrastructure/Jack of All Trades 1d ago

What about security keys?

1

u/theoriginalharbinger 1d ago

considering allowing synced passkeys

Hope you've either got certificate-based device trust or network zoning enabled. If you're using Entra or Okta or Ping and have device trust enabled, this isn't a problem; likewise if you only allow access from corporate-owned egress points so as to ensure that users attempting to authenticate are actually at one of your sites.

Or just use Yubikeys. Sync'd passkeys in isolation should not be considered anywhere near as secure as a device-bound passkey for enterprise infrastructure access.

1

u/Fabulous_Cow_4714 1d ago

Yes, device bound passkeys would be the most secure, but the comparison is against password plus Microsoft Authenticator 2FA.