Registered passkeys are held in the Passkeys record, which browses and audits like anything else, so you can see who has passkeys and how many.
Helping a user who has lost every device
Remove their passkeys. They can then sign in with their password and register a new one. Removing a user's last passkey does not lock them out — password sign-in always remains available.
Treat these requests with appropriate suspicion. "I've lost my phone" is a convenient thing for an attacker to claim; verify who you are speaking to before removing anything.
Step-up re-authentication
Some actions are sensitive enough that simply being signed in should not be enough — removing a passkey being the obvious example. For those, ActiveManage requires that a strong authentication happened recently.
A full sign-in, or a successful step-up, stamps the session. Sensitive actions check whether that stamp is inside the window, which defaults to five minutes. A user who signs in and immediately manages their account is not asked twice; somebody who wandered off two hours ago is.
Two ways to step up
- Passkey — offered where the user has one. The challenge is always narrowed to their own credentials.
- Password — the fallback, and the only route for a user with no passkey.
Using it for your own sensitive actions
The same protection can be applied to anything your business considers sensitive — changing bank details, exporting a dataset, closing an account. The mechanism is already there; ask whoever maintains your application to apply it.
Worked Examples
- Payment details: require step-up before a supplier's bank account can be changed — a direct defence against invoice fraud.
- Bulk export: require step-up before a full customer export.
- Shared workstations: shorten the window so an unattended session cannot be used for anything sensitive.