Passkey rollout playbook

Before you start

Decide what success looks like and who owns it. A named owner, a pilot group and a date for the first review are enough to begin.

• Pick one owner and one sponsor.
• Define success: for example, the share of active users with a passkey, and the fall in password-reset tickets.
• Inventory devices people use: managed laptops, personal phones, shared workstations.
• Confirm your applications sign in through your identity provider, so one passkey covers many apps.

Phase 1: the pilot (2 to 3 weeks)

Choose 20 to 40 volunteers across functions and device types, including some from IT support so they learn it first.

• Include at least one person on each operating system and browser you support.
• Ask pilot users to register two passkeys: for example a laptop's built-in one and a phone or security key.
• Keep the authenticator app code as a fallback for now.
• Log every issue and every question; these become your help-desk notes.

Phase 2: administrators first

Administrators carry the most risk, so give them the strongest factor early. Security keys suit them well because they are portable and phishing-resistant.

• Require passkeys or security keys for all admin roles.
• Pair this with step-up re-authentication for sensitive admin actions.
• Make sure at least two break-glass administrators have registered keys stored safely.

Phase 3: everyone

Roll out department by department over a few weeks, never everyone on one Monday.

• Announce with a short how-to video or screenshot guide in plain language.
• Run drop-in sessions during the first week of each group.
• Prompt users to register at sign-in rather than asking them to find a settings page.
• Offer security keys to people without a suitable phone or laptop.

Recovery and lost devices

Most rollout stress comes from lost phones. Decide the recovery route before launch and test it.

• Require two registered passkeys where possible.
• Define how the help desk verifies identity before resetting: for example a manager confirmation plus a call-back.
• Let admins suspend the account if it is at risk, which signs the person out everywhere. The person removes the lost passkey themselves from a device they still have.
• Record every recovery in the audit log.

Help-desk script

• Ask which device the person is on and which passkey they registered.
• Do not read out or ask for codes or secrets.
• If the device is lost, follow the recovery route and revoke sessions.
• After recovery, ask the person to register a second passkey.

Retiring passwords and codes

When most people have a passkey, narrow the fallbacks. Keep one for recovery, but stop offering text-message codes for accounts that no longer need them.

• Set a date after which new accounts get a passkey at first sign-in.
• Reduce password use group by group, watching ticket volume.
• Keep the authenticator app as a managed fallback; treat text-message codes as the last resort.
• Review sign-in logs for people still using weaker methods and follow up.

Measures to track

• Share of active users with at least one passkey, and with two.
• Password-reset and lockout tickets per week.
• Sign-ins by method.
• Time to resolve a lost-device case.