Login app iconLogin

Passwordless enterprise · For IT

Passkeys for everyone. Passwords for no one.

Most large organisations can already move administrators and office staff to passkeys. The frontline, where people share phones, laptops and tills, is where passwords hang on and where phishing still gets in. Login closes that gap, so every employee signs in the same way: without a password, without friction, and without anything a fake login page can steal.

  • Passwordless
  • Frictionless
  • Phishing-resistant

The whole company at a glance

One-time passFirst day and every recovery
  1. Identity checked, short-lived pass issued
  2. Employee signs in once with the pass
  3. Employee registers a passkey
  4. Pass expires; only the passkey works

Administrators

Privileged roles, just in time

  • Two security keysPrimary and backup FIDO2 keys, PIN plus touch
  • Admin workstationSeparate admin account on the key
Policy
Device-bound, attested, approved key models
Pass
Only after an in-person ID check
Details ↓

Office workers

Their own phone and laptop

  • SmartphonePasskey in an authenticator app; signs in other devices by QR
  • Windows or MacBuilt-in passkey in the TPM or Secure Enclave
  • Cloud PCConsultants sign in by phone QR
Policy
Device-bound, attested, app and platform
Pass
Only for a new phone
Details ↓
Your identity providere.g. Microsoft Entra ID

Three groups, one set of rules. The sections below explain each part.

The ground rules

Five rules that hold for every employee.

These are set once in your identity provider (for example Microsoft Entra ID) and apply to all apps. The personas below only differ in which passkeys they are allowed to use.

Phishing-resistant only

Every sign-in uses a passkey or FIDO2 security key. Passkeys are bound to the real site, so a look-alike page gets nothing it can replay.

A one-time pass is the only way in

New staff and lost credentials both start with a short-lived pass (Temporary Access Pass in Entra ID). SMS, voice and authenticator codes stay switched off.

Passwords exist but go unused

Accounts keep a long random password that nobody knows. It is never offered as a fallback.

Policy per persona group

Each group gets its own passkey policy: device-bound or synced, attestation required or not, and which authenticator models are allowed.

Device unlock stays local

Screen PINs, fingerprints and face unlock never reach the identity provider. They only release the passkey on that device.

Onboarding and recovery

The same four steps, every time.

First day, new phone or lost badge: the path is identical. Because recovery never falls back to a password or a code, there is no weaker door for an attacker to try.

  1. Verify the person

    An authorised admin or manager checks identity and issues a one-time pass with a short lifetime.

  2. Sign in once with the pass

    The employee uses it to reach the registration page. It works for nothing else.

  3. Register a passkey

    On a phone, laptop, security key or badge, depending on the persona.

  4. The pass expires

    From now on only the passkey works. A lost credential means a new pass, never a reset link.

Keep the pass single-use and short-lived. Who may issue one is part of the persona policy below.

By persona

Three kinds of employee, three kinds of passkey.

Most organisations fit these three groups. Map each to a security group in your identity provider and give it its own passkey policy and authentication strength.

Persona 1

Administrators

People with privileged roles, activated just in time when needed. They get the strictest policy: hardware keys only.

Passkey policy
Device-bound only, attestation enforced, allow-list of approved security-key models.
Optional
Require a compliant managed device. For a roaming key this is the only tie to specific hardware.
One-time pass
Single use, issued only by a dedicated authentication admin after an in-person ID check.

  • Primary security key

    A FIDO2 hardware key, such as a YubiKey, unlocked with PIN and touch. The private key never leaves it.

  • Backup security key

    A second key registered on day one and stored separately, so losing one rarely means a new pass.

  • Admin workstation

    A dedicated laptop and a separate admin account, signed in with the security key.

Persona 2

Office and knowledge workers

One person, their own devices. Every device holds its own device-bound passkey, and the phone bootstraps the rest.

Passkey policy
Device-bound, attested. Allow the authenticator app and the computers' built-in platform credentials.
Optional
Require managed laptops (they usually already are). Exempt the phone and cloud PC access.
One-time pass
Only needed for a new phone. Laptops are set up from the phone.
  1. 1The pass registers a passkey on the phone
  2. 2The phone signs in on the laptop by QR code
  3. 3The laptop creates its own passkey

  • Smartphone

    Unlock
    Screen PIN plus face or fingerprint
    Passkey
    In an authenticator app (such as Microsoft Authenticator), also used to sign in on other devices by scanning a QR code

  • Windows laptop

    Unlock
    Windows Hello PIN plus face or fingerprint
    Passkey
    Windows Hello for Business, kept in the TPM*

  • Mac

    Unlock
    Local password plus Touch ID
    Passkey
    A platform credential in the Secure Enclave, via Platform SSO*

  • Consultants on their own machines

    Sign in to a cloud PC in the browser with the phone passkey via QR code. The cloud PC is the managed device, so the consultant's own laptop never needs enrolling.

* Built-in platform credentials, not roaming keys. The Mac credential also answers browser passkey prompts; Windows Hello for Business is registered as its own sign-in method.

Planning a rollout?

Start with one site.

The frontline group is usually the hardest to move off passwords, and the quickest win once the badges are in place. We can help you pilot it on a single site before you roll it out to the rest.

Talk to us about a pilot →

support@phenomenal.se