Passkeys Don’t Know Who’s Enrolling Them

Executive summary: The article warns that while passkeys strengthen authentication, Entra ID’s default self-service registration authenticates sessions but does not verify the human enrolling a passkey, enabling account-takeover followed by durable passkey enrollment; it recommends integrating a third-party identity verifier (Nametag) as an External MFA method and enforcing it via Conditional Access so passkeys are only issued after biometric ID verification.