Your Employer Forced Passkeys Through SSO — What To Do

A short email says passkeys are now required for your work account and you should enrol by Friday. Nothing is broken yet. Here is what changed, what to do in the first half hour, and what to sort out before your access is switched off.

Your work account is a different identity from your personal ones

A passkey you create for work is not "your" passkey the way the one on your bank is. It lives inside your employer's identity system, usually an SSO provider the company administers. Three consequences follow:

• The organisation can take it away. An administrator can revoke the credential, remove the device it lives on, or reset your account without asking you. It is a key to company resources, not a personal possession.
• It is tied to hardware your employer controls. If it is registered on a managed laptop or phone, a policy wipe removes it along with everything else on the device.
• It must never become the recovery path for personal accounts. The usual damage is not a stolen passkey. It is a personal account whose recovery email was your work address, which stops working the day you leave.

So the goal is not to resist the rollout but to keep the two worlds from touching: work credentials stay inside work, and nothing personal depends on work infrastructure. If you are deciding how to organise the personal side, our comparison of password managers that handle passkeys is a reasonable starting point.

Day one: four things to do before you close the tab

1. Enrol from the service, never from the email link. Open a new tab, type the address of the SSO page yourself, sign in normally, then start enrolment from the security settings there. This one habit defeats most of the attacks below.
2. Register a second factor, not just the first passkey. One passkey on one device is one point of failure — the device that gets dropped, replaced, or wiped. Add a second passkey on another device you control, or a hardware key. If only one is permitted, at least know which backup method exists.
3. Move the recovery codes off the device. If enrolment produces one-time codes, put them somewhere that is not the laptop holding the passkey and not a note on the same phone. Paper in a drawer at home is fine; a text file in your work drive is not.
4. Test the whole path while IT is awake. Sign out fully, sign back in with the passkey, then look at what the account offers when the passkey is unavailable. Doing this on a quiet afternoon is a chore; doing it the morning of a deadline is an outage.

Check what syncs and what does not

Some passkeys sync through your platform account; others are bound to one piece of hardware. On a managed device, the syncing side is often a work profile that dies with your employment. Check rather than guess: read the passkey list in the account's security settings, then read your device's own passkey settings to see whether entries say they are stored in your account or on this device only.

When the device is wiped, replaced, or you leave

Both events take the work credential with them. Device-bound passkeys on a managed laptop disappear with the wipe; synced passkeys tied to a company account disappear when it is closed. Neither is a catastrophe if you prepared.

Before your last day, in this order

1. Ask IT in writing which accounts and credentials are removed at offboarding, and when.
2. Find every personal account that used your work email, work number, or work device as a recovery route and repoint it to a personal address, while the mailbox still works.
3. Remove the work credential from personal devices: the work profile on your phone, and any work passkey in your personal password manager.
4. Sign out of sessions on the work account and hand the device back.

If work and personal accounts share one password manager, that separation deserves a hard look — see passkeys versus password manager first and our notes on passkey recovery in password managers.

Telling a real rollout from a lookalike page

Passkeys are hard to phish because the credential is bound to the real domain. The weak point is the moment you are persuaded to set one up somewhere else, on a page built to capture your password.

Genuine:

• The instruction arrives through a channel that already existed — the IT portal, the internal chat tool, a known administrator — not a cold email with a button in it.
• You start enrolment yourself, after signing in normally, from the service's own security settings.
• The address bar matches the service domain exactly, including everything before the first single slash.
• The prompt to create the passkey comes from your own device or browser, not from a form on the page.

Close the tab and re-enter the address by hand if:

• A link in a message lands on a "passkey setup" page you did not ask for.
• A page asks you to re-enter your old password and a code to "verify" or "migrate" a passkey.
• Anyone asks you to send a code, a QR image, or a screenshot of your passkey screen in chat. Legitimate support never needs that.
• There is urgency, a countdown, or a threat that the account closes today.
• A QR code is offered to "move your passkey" when you did not start that move.

Checklist

Step	Why it matters	Done when
Enrol from the service, not from an email link	Defeats lookalike setup pages	You reached the SSO page by typing the address yourself
Add a second factor or second passkey	One device is one point of failure	You have tested a backup sign-in path
Store recovery codes off the device	A wipe must not take your way back in	Codes exist on paper or in a personal account
Check what syncs and what is device-bound	It tells you what a wipe would remove	You have read the passkey list in account settings
Repoint personal accounts off work email and number	Offboarding closes that mailbox	No personal account uses a work address for recovery
Remove work credentials from personal devices	Work policy should not reach personal data	Work profile deleted; work passkey removed from your manager

Last updated: 2026-10-16

Stuck mid-enrolment, or locked out already? Passkey troubleshooting walks the failure modes in order, and passkey backup and recovery covers keeping a second way in.