@merill while I’m a huge fan of the usability benefit, and this is unquestionably a good thing for regular users…
…it does bother me that we are slinging key material around which was supposed to be hardware-bound.
@markeldo I think the goal was to replace passwords
If we are going to get the world to adopt passkeys over passwords this might be the only way.
@merill related, is there any way in Entra to identify whether a passkey/FIDO2 Authenticator is hardware bound (like a yubikey or TPM), or software bound like Google Authenticator/iCloud/1Password?
I thought no, but maybe there’s something new in the WebAuthN standard?
Merill Fernando 
Mark Eldridge