Passkeys are rapidly being adopted across Azure environments as a phishing-resistant authentication method. While they offer strong security benefits when properly configured, they also introduce new attack surfaces that allow attackers to convert initial access into long-term persistence.

​

Join us as we examine how attackers can move from compromised credentials or session tokens to registering persistent passkeys that survive password resets and traditional session revocation. We break down the registration and authentication flows, the differences between attested device-bound passkeys and synced passkeys, and the configuration options available in Entra ID that directly impact attack feasibility.

​

Attendees will see practical techniques for converting captured authentication material into usable passkeys, using those passkeys to obtain tokens across Azure services, and operating automated agents with the resulting access. We also explore methods for storing and managing these credentials in ways that enable long-term, low-detection persistence within Azure environments.

​

The session concludes with a focused discussion on detection opportunities, response considerations, and effective remediation steps that security teams can implement to reduce risk. Real-world examples and recommended client guidance are included throughout.​