Face ID, Touch ID, Windows Hello
Passkeys use the platform authenticator or password manager selected by the user and browser.
Strong verification
Passkeys and MFA before private app access
Users can register a passkey, sign in without typing a password and re-verify before opening a private app. The confirmation is short-lived, so an open browser session does not become indefinite app access.
TOTP, passkey registration/login and fresh app-launch verification are implemented. Workspace-wide MFA policy and step-up for every sensitive admin operation remain policy-layer work.
WebAuthn/passkey registrationDiscoverable passkey loginTOTP authenticator codesFresh app-launch assertion
User flow
Verify the person, not only the browser session
Before a sensitive private app opens, BusinessProxy can ask for a recent TOTP or passkey assertion. The backend validates that the factor belongs to the user and that the assertion has not expired.
Authenticator code fallback
TOTP can be used as a practical factor where passkeys are not yet rolled out to every user.
Short-lived assertion
The app launch receives a time-limited assertion token instead of reusing the account password.
Where it applies
Portal, branded app pages and mobile launch
The same MFA primitives support account setup, passkey login, private app launch from the web portal and mobile private-app launch.
- Passkey setup includes user verification.
- Branded app domains use their own WebAuthn RP ID.
- Expired or invalid MFA assertions fail closed.
- The user sees action-focused copy: set up, verify and open.
Current boundary
Strong factors are live; broad policy enforcement is next
Passkeys and TOTP are available for sign-in and fresh verification before app launch. Organization-wide MFA requirements and step-up for sensitive admin actions belong to the next enterprise policy layer.
- No absolute "phishing-proof" wording.
- Device-posture checks are separate from MFA.
- Workspace-wide MFA policy is still separate policy-layer work.
Next step
Review the rollout details before turning it on
The documentation page shows what to configure, how to verify the setup and which operational boundaries to review before rollout.