🔑 Device-Bound Passkey
A device-bound passkey is created and stored on a single device, and never leaves it. This is different from a synced passkey, which can be recovered on a replacement device through a passkey manager such as Apple Passwords or Google Password Manager.
This is what Microsoft Authenticator sets up
When you use Microsoft Authenticator to create a passkey, it currently creates a device-bound passkey
on that phone. It is not copied to a replacement phone automatically - you would set up a new one
there.
Excellent for managed corporate devices
Because a device-bound passkey cannot be copied or moved, it provides strong security for devices that
are centrally managed by IT - but you will normally need to register a new passkey when you move to a
new device.
At a glance
- ✅ Passwordless
- ✅ Phishing-resistant
- ❌ Does not sync to another device
- ❌ Must be recreated on a new device
Examples
- Windows Hello for Business
- Platform SSO on macOS
- Some hardware-backed device credentials
This is usually set up automatically
Device-bound passkeys are typically configured automatically by your organisation's IT policy when you
sign in to a managed device, rather than through self-service setup. If you are asked to set one up
manually, contact your IT support team for guidance.