Passkeys

What Are Passkeys?

Passkeys are a modern, passwordless authentication method designed to replace traditional passwords with a more secure and user-friendly solution. Developed based on the FIDO2 and WebAuthn standards, passkeys allow users to log in to websites and apps using biometrics (fingerprint, face scan) without needing to remember or manage passwords.

Passkeys in Veridium

Sign in with Passkey

• The platform introduces a “Sign in with passkey” button, improving user experience by enabling passwordless, username-less sign-ins:

  • Utilizes discoverable (resident) credentials, meaning the authenticator identifies the user without requiring a prior username input.

  • Initiates an “Opportunity” session (identity-less), then binds the authenticated user after successful passkey validation.

FIDO-Certified Authenticator & Device-Bound Passkeys

Veridium mobile application acts as a certified FIDO2 passkey provider: It generates and securely stores device-bound credentials (i.e., private keys that never leave the device) compliant with FIDO and WebAuthn standards. This ensures strong, phishing-resistant authentication.

Native Biometrics & PIN with Policy-Driven Offline Support

• Veridium leverages the device’s native biometrics (e.g., fingerprint, face ID) and PIN-based authentication for user verification.

• Administrators may allow usage of Veridium PIN usage in Passkey scnearios are managed synchronized to the device for offline use.

Microsoft Entra Passkeys

• Veridium supports passkey enrollment into Microsoft Entra ID:

  • During enrollment, Veridium’s mobile app generates FIDO2 credentials and registers them directly with Microsoft Entra ID, making the passkey available as an authentication method in Microsoft Entra.

  • This automatic enrollment ensures that passkeys created via Veridium are fully managed within the enterprise identity infrastructure.

Contextual and Behavioural Data

VeridiumID can enrich server-managed passkey authentication with authentication, device, location, and behavioural information collected through the Veridium mobile SDKs on Android and iOS.

This information complements passkey authentication by providing additional context for ILP risk analysis, auditing, investigation, and authentication policy evaluation.

Supported scenarios

Veridium FIDO Server: Context collected by the mobile device is associated with the existing VeridiumID authentication event.

Microsoft Entra passkeys: The Veridium mobile client collects the relying-party and authentication information needed to correlate the passkey operation with its contextual data. VeridiumID does not control the Microsoft Entra authentication ceremony itself.

Supported use cases include hybrid/cross-device authentication for Veridium and Microsoft Entra passkeys, together with supported Veridium BLE and mobile passkey integrations. Transport availability depends on the mobile platform and integration.

Information collected

The collected information is associated with the corresponding passkey authentication event.

ILP processing and retained data

Contextual and behavioural information can be submitted to ILP for analysis. VeridiumID associates the resulting ILP information with the relevant passkey authentication record.

The server retains the relevant authentication context, device context, location metadata, and ILP processing result. Raw behavioural sensor data is forwarded for ILP processing and is not retained as part of the server-side passkey authentication record.

Important: Contextual passkey reporting does not automatically reject an authentication solely because of an ILP risk score. Authentication behavior remains controlled by the policies configured for the environment.

Reporting modes

Asynchronous reporting allows passkey authentication to proceed without waiting for contextual data delivery. If immediate submission is unavailable, the mobile client retains the pending information and retries when delivery becomes possible.

Synchronous reporting submits contextual information during the active passkey authentication workflow. It can be used where server-side authentication policy must be evaluated before the passkey process continues.

The applicable reporting mode can depend on the relying-party integration and authentication scenario.

Pending context is retained locally before successful submission, allowing it to survive temporary network loss, service unavailability, and application restarts. After successful submission, the locally retained reporting data can be removed.

Passkey reporting policies

The following policies control contextual reporting:

Authentication policy evaluation remains managed by the VeridiumID policy layer.

Privacy considerations

Configure context collection, location requirements, reporting, and retention according to the organization’s security requirements and privacy policies. Location availability remains subject to permissions granted by the device user and restrictions imposed by the mobile operating system.

Lifecycle Management & Revocation

Passkey lifecycle is centrally managed:

• When a device is deregistered in Veridium, associated passkeys are automatically revoked including Microsoft Entra ID passkeys managed by Veridium, ensuring lost or compromised devices cannot authenticate.

• Policies in Veridium Manager control passkey enrollment (mandatory or optional) and provide orchestration hooks for removal.

Veridium aligns with WebAuthn specifications, continuing evolution of its FIDO server to support enhanced security, interoperability, and standard compliance proving a robust, enterprise-grade passkey solution — blending local device-bound security, flexible biometric/PIN policies, seamless user experience.

Last updated: September 21, 2026