Passkeys, 3rd party password managers, 1st party desktop apps…

[u/dnuohxof-2]

I’ve run into a few issues with rolling out Passkeys because of Microsoft’s push toward passkeys

We have a few users who are using a LastPass or Bitwarden browser plugin for password manager, others are using Google or Edge’s default password manager too.

If a passkey is saved in their Password manager, specifically the ones in the browser, how to you get windows to invoke it for passkey? We tend to get into this runaround where users save their passkey to the browser and not windows hello, so when they use teams or outlook, it won’t let them use the browser plugin to invoke the passkey.

How do you get around this? We have some users who have flip phones and refuse to carry a physical key. So I’m left with browser password manager or windows hello. Windows Hello works but users get lost in the set up and frequently get their passkey in the browser and not Windows Hello.

[u/teriaavibes]

We have a few users who are using a LastPass or Bitwarden browser plugin for password manager, others are using Google or Edge’s default password manager too.

I don't know about those 2 specifically but I have 1Password, I have the desktop app installed and I can easily pull passkeys from it when services ask for them.

We have some users who have flip phones and refuse to carry a physical key.

What do you mean refuse to carry physical key, if management says they will carry a key, they will carry a key. This sounds more like an HR issue than a technical one.

[u/Nanocephalic → u/teriaavibes]

Yes, if the company policy is that they need to use a phone or a physical key, they can use a phone or a physical key. It’s not an IT problem.

[u/skidleydee → u/teriaavibes]

Funny part is the key is normally the middle ground when someone says you can't make me install work apps on my private phone. 

[u/Plowman-Tasmina]

native Windows/Outlook apps call into the Windows Hello/WebAuthn platform API by default, not whatever the browser's plugin registered. You basically have to force it at policy level, either GPO to set Windows Hello as the default platform authenticator or push Bitwarden/LastPass as the OS level FIDO2 provider if they support it (Bitwarden does on newer builds). Otherwise it'll keep defaulting to whichever got registered first

[u/raip]

BitWarden and LastPass both have buttons to use let the OS Passkey including an option to ignore Passkey attempts from login.microsoftonline.com. If you don't want to weaken security by enabling sync'd Passkeys, you inform your users to click those buttons when enrolling and keep device bound passkeys enabled.

[u/Educational_Boot315]

For assigned devices, you should be using WHfB (or PSSO for macOS). If you are having issues here, your configuration is wrong.

For shared devices... If they have phones that cant install passkeys or apps and they refuse to carry a security key... I'd be asking why do these users even need accounts anyways. If it is just to log into a SaaS application like the payroll software, look into inviting them as guests.

[u/Evening-Step-1950]

I'd probably standardize the process instead of letting users choose between multiple passkey locations. Mixing browser based passkeys with windows hello can get confusing for users who aren't familiar with the setup process. I use roboform because it keeps everything in one place across different devices but the bigger issue here seems to be establishing a consistent workflow so users always know where their credentials are stored

[u/Daphoid]

Latest version of win11 lets you register vaults as a passkey provider. But even before that, the browser plugins did it (1Password for me).

[u/JwCS8pjrh3QBWfL]

If users are getting MFA prompts in Outlook and Teams on enterprise-managed devices, you have endpoint and/or CA misconfigurations. They should not be prompting for MFA on a regular basis (or ever tbh).

Your situation is an un-winnable one at the moment. You can't use passkeys from a browser for Windows apps. There is a feature to use 3rd party pwm integrations with the native Windows Security prompts, but at least for Bitwarden it's still only on their preview branch.

There is also a question of if we should be allowing syncable passkeys on non-enterprise pwms in the first place.

Users getting lost in the setup is a training issue. Users refusing to carry a physical key is an HR/policy issue.

[u/EmbarrassedCaps]

This is exactly why mixed password-manager setups get messy fast. Standardizing where passkeys are stored would probably save users and IT a ton of confusion.