Passkeys Explained, and Choosing the Right Model

Source: Shell is Only the Beginning

Author: Carlos Perez

URL: https://www.darkoperator.com/blog/2026/10/18/passkeys-explained-and-choosing-the-right-model

https://www.darkoperator.com/blog/2026/10/18/passkeys-explained-and-choosing-the-right-model

ONE SENTENCE SUMMARY:

WebAuthn passkeys stop AiTM phishing via origin-bound public-key cryptography, while Entra passkey profiles tailor device-bound versus synced credentials per persona.

MAIN POINTS:

  1. Passkeys are per-site key pairs; only public keys reach Entra ID.
  2. Origin binding prevents authenticators from responding to lookalike phishing domains.
  3. Possession plus biometric/PIN provides MFA in one gesture without shared secrets.
  4. Passkeys don’t address device-code phishing, cookie theft, or social-engineered helpdesks.
  5. Entra supports device-bound options: security keys, Authenticator, Windows Hello, Platform SSO.
  6. Synced passkeys live in E2E-encrypted providers like iCloud, Google, 1Password, Bitwarden.
  7. Attestation enables make/model verification; synced passkeys never support attestation.
  8. AAGUID allow/block lists are reliable only when attestation is enforced at registration.
  9. Persona-based tiers guide controls: admins attested device-bound; workforce may allow synced.
  10. PowerShell/Graph tooling inventories profiles, policies, and user passkeys for enforcement validation.

TAKEAWAYS:

  1. Prefer passkeys to defeat proxy-based phishing because credentials won’t work off-origin.
  2. Use synced passkeys for low-cost rollout, accepting weaker provenance assurance.
  3. Reserve attested device-bound authenticators for Tier 0 and regulated roles.
  4. Build passkey profiles per persona; multiple profiles add allowances, exclusions override all.
  5. Operate AAGUID policy changes carefully since removals can instantly lock out users.