Running it day to day

A good order for a campaign

1. Send yourself a test, then a pilot of 5 to 20 people, IT first.
2. SMS and voice users next: they can prove who they are remotely.
3. Then code apps, then people with nothing registered.
4. Then Authenticator push users, to move them on to passkeys.

Someone has lost every device

For a promoted person:

1. Remove them from Passkey-PhishingResistant.
2. Check who they are: call back on a number from HR or the directory, not one they give you.
3. Issue a one-time Temporary Access Pass in Entra with the shortest lifetime that works.
4. Give it by voice or in person, never by email or chat.

They add a new passkey and are promoted again once they've used it.

People who can't use a smartphone

Mark them as an exception with a reason and a review date. A security key or hardware token still counts as done if they register one.