A 400‑person company rolls out passkeys in Entra ID, with phishing-resistant sign-in for administrators first and a recovery process that holds up
A technology and services company of about 400 staff with offices in Florida and Texas, a leader in its segment.
- Scale
- About 400 users, 14 administrator accounts, 2 passkey types (hardware security keys and passkeys in the phone's authenticator), 5 rollout waves, 1 identity provider, 1 recovery process
- Engagement
- Three weeks of design and a pilot with IT, then administrators in the first month and the rest of the staff in waves over about four months
The challenge
Everyone at the company signed in with a password and a push approval or a six-digit code. An attacker who sent a convincing fake sign-in page could collect both, and two staff members had approved push prompts they did not start (a tactic known as MFA fatigue). Administrators used the same kind of sign-in as everyone else, and some used their daily accounts for admin work. The insurer's renewal form asked about phishing-resistant MFA, and the help desk dreaded any change that would add reset tickets in the middle of a busy quarter.
Passkeys are phishing-resistant because the private key never leaves the device and the sign-in is bound to the real site's address, so a fake page has nothing to capture. That is why the order mattered here: the accounts an attacker wants most, the administrators, moved first, and the rollout for everyone else used what the pilot had taught about devices and apps.
The recovery process decided the project's success more than the technology did. A passkey is only as strong as the way an account is restored, so the help desk verified identity through a known channel and issued a time-limited pass instead of resetting by text message, which would have handed attackers the weak path around the new control.
What our team delivered
- A sign-in inventory from the identity provider's logs: which methods users actually used, which legacy protocols and apps still accepted passwords alone, which devices could hold a passkey (current Windows with Windows Hello, recent iPhones and Android phones, Macs with Touch ID) and which shared or kiosk accounts could not
- Administrators first: each of the 14 admins got a separate admin account with no mailbox, two FIDO2 security keys registered (one carried, one stored in a safe as the spare), and a Conditional Access policy using an authentication strength that accepts only phishing-resistant methods (passkeys, FIDO2 keys, Windows Hello for Business or certificate-based sign-in) for all administrator roles. Two emergency accounts, excluded from the policy and protected by long random passwords and alerts on every use, were kept for a failure of the identity provider itself
- A passkey pilot with the IT team and 25 volunteers in different roles, using the passkey in the phone's authenticator app for most staff and Windows Hello for those who work on a company laptop all day. The pilot found two line-of-business apps that did not support modern sign-in and one shared mailbox login that needed to become a proper shared mailbox
- A recovery process written before the wave began: a new device is enrolled with a time-limited Temporary Access Pass issued by the help desk only after identity verification (a callback to the manager on a number from the HR system, never to a number the caller supplies), no recovery by text message or by email, and a second passkey required within 30 days so no one depends on a single device
- Waves by department, each with a short guide, a 20-minute drop-in session and a registration campaign that nudged users in the sign-in flow. Password sign-in was not removed at once: after each wave, the sign-in logs were checked for users still using passwords and for apps that failed, then the policy moved from report-only to enforced
- Measures taken from the first week: the share of sign-ins using a phishing-resistant method, median sign-in time, failed sign-in rate, and help-desk tickets per hundred users for sign-in and reset problems, compared with the three months before
Result
After the last wave, 91 percent of interactive sign-ins used a passkey or a hardware key, administrator sign-in was phishing-resistant for all 14 accounts, and the median sign-in took about 6 seconds instead of about 19 with a password and a prompt. Sign-in tickets rose by about a third in the two weeks after each wave, mostly lost phones and first-time registration, then fell below the earlier level, and the help desk handled recovery with one script instead of improvising. The remaining 9 percent were kiosks, a few contractors on personal devices and two older apps, each with a written exception, a compensating control and a review date. Passkeys do not stop every attack, since a stolen session cookie can still be replayed, so the company kept token protection, device compliance checks and sign-in risk alerts alongside them. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 4 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Five million events, three escalations
What a managed SOC does to a day of log volume for a 250‑seat organisation. Collection produces millions of events; correlation rules turn them into a thousand or so alerts; triage merges and dismisses most of those into dozens of incidents; only a few need a human on the customer side. Bar length is the logarithm of the count, so each step is orders of magnitude. Illustrative figures.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.