Synced vs device-bound passkeys
Verdict: Synced passkeys are the low-cost choice for the general workforce. Enforcing attestation excludes synced passkeys and allows only device-bound ones, giving verifiable device provenance for privileged use.
| Criterion | Synced passkeys | Device-bound passkeys |
|---|---|---|
| Cost and convenience | Lowest cost, phone unlock gesture | Higher, dedicated hardware |
| Attestation support | Not supported, excluded when enforced | Required when attestation enforced |
| Device provenance | No | Verifiable via FIDO Metadata Service |
| Best fit | General workforce | Regulated or privileged accounts |
Rules
- Synced passkeys are the lowest-cost, most seamless option for the general workforce, using the device's native unlock gesture.
- Enforcing attestation on the passkey policy excludes synced passkeys and allows only device-bound passkeys.
- Attestation gives verifiable device identity through the FIDO Metadata Service, limiting registration to device-bound passkeys.
Traps
- Synced passkeys are not auto-converted to device-bound; they simply become unusable once attestation is enforced.
- Synced passkeys cannot satisfy an attestation or device-provenance requirement.