Migrating IAM systems to support passkeys: challenges and solutions

Migrating IAM systems to support passkeys Challenges and solutions

Modernizing identity and access management (IAM) to enable passkeys is shifting from “nice to have” to a competitive necessity for enterprises. As identity-based attacks and phishing campaigns reach unprecedented scale, it’s clear that passwords and legacy MFA are insufficient for today’s threat landscape. Transitioning to passwordless authentication based on the FIDO2/WebAuthn standard using passkeys represents a leap forward in both security and user experience for organizations ready to evolve.

But migrating existing IAM systems to support passkeys brings considerable technical and organizational complexity. Drawing on Secfense’s experience supporting BNP Paribas Bank Polska one of the first global banks to launch passkeys for corporate clients at scale this article outlines stages of IAM migration, key technical barriers, and proven implementation strategies for a seamless and secure transition.

Migrating IAM Systems to Support Passkeys: Challenges and Solutions

Why Migrate to Passkeys?

  • Passkeys offer phishing-resistance by eliminating shared secrets.
  • They raise authentication security while simplifying user login flows.
  • Enhanced compliance with frameworks like PSD2, DORA, NIS2, and GDPR is more attainable.
  • The burden and cost of passwords reset requests, IT helpdesk, password leaks, credential stuffing are drastically reduced.[1][2][3]

Stages of IAM System Migration to Passkeys

A typical migration journey evolves through these main phases:

  1. Assessment and Strategy
    • Evaluate current IAM landscape, authentication flows, and regulatory needs.
    • Identify systems and applications most vulnerable to credential-based attacks.
    • Build a migration roadmap minimizing disruption and risk.
  2. Proof of Concept (PoC) and Pilot Testing
    • Limit early deployment to a select user group (“friends & family”) to test UX and system compatibility.[4]
    • Use feedback to refine backend processes and user interfaces.
  3. Hybrid Mode Deployment
    • Operate passkeys alongside legacy authentication (passwords, MFA) to maximize business continuity and ease user onboarding.
    • Allow users to choose their authentication method during a transition window.
    • Ensure no changes to existing business-critical apps or IAM logic are required.[4][1]
  4. Organization-Wide Rollout & Opt-In Expansion
    • Gradually expand passkey support to broader groups.
    • Run targeted user education campaigns on passwordless benefits and use.
  5. Full Passwordless Migration (Optional)
    • Decommission passwords once adoption and technical readiness reach target levels.

Technical Barriers to Passkey Enablement

1. Integration with Legacy and Complex IAM Landscapes

Many organizations have grown through mergers and acquisitions, leaving them with fragmented identity systems, multiple authentication protocols, and legacy applications. Modifying these applications to support passkeys can threaten stability and incur massive cost and risk.[5][3][4]

2. Maintaining Compliance and Auditability

Heavily regulated sectors (finance, healthcare) must meet demanding audit, logging, and compliance requirements. Any IAM migration must preserve or enhance compliance with standards like PSD2 RTS for strong customer authentication and ensure robust key management and lifecycle documentation.[2][1][4]

3. User Experience and Platform Compatibility

The path to passwordless must be frictionless for end-users. But passkey experience varies by OS/browser, and even advanced users face confusion over sync, recovery, and multi-device access. Applications may require new UI elements for passkey registration, management, and fallback flows sometimes impossible to add without code changes.[3][6]

4. Security and Risk Mitigation

Fallback methods (recovery options for lost keys/devices) must not reintroduce weak security. Secure backup, revocation, and attestation controls across multiple device ecosystems require fresh policies and technical solutions.

How to Implement Passkeys and Passwordless Authentication in Your Organization

Implementation Strategies: Overcoming Common Challenges

1. The Secfense User Access Security Broker (UASB) Approach

Secfense has pioneered a layer-based, agentless method for enabling passkeys on any IAM stack without modifying application code or disrupting business operations. At BNP Paribas, Secfense provided an integration layer that:

  • Injected passkey logic into existing application flows via the load balancer, introducing passkey UI and logic dynamically, with zero code changes to core business apps.[1][4]
  • Seamlessly routed passkey authentication traffic to a dedicated FIDO2 server, leaving legacy flows untouched.
  • Made it possible to run legacy and modern authentication side-by-side, reducing migration risk and maximizing uptime.[2][4][1]
  • Ensured full compliance, strong separation of authentication mechanisms, and robust audit trails.

2. Phased, Opt-In Migration and Fallback Control

  • Launch with a limited “opt-in” pilot to control risk and collect real-world feedback.
  • Use backend user targeting (not risky email links or cookies alone) to activate the passkey flow for specific users.[4]
  • Provide secure fallback and key management workflows (registration, revocation, device recovery) tightly coupled with strong authentication.

3. “No-Code, No-Agent” Integration for Maximum Scalability

  • Avoid risky and expensive application rewrites by leveraging network-level interventions (like content adaptation in the load balancer) and flexible security brokers.[1][4]
  • Deliver new authentication methods (passkeys, strong MFA, biometrics) across all applications even legacy or third-party regardless of backend technology.

4. Regulatory Compliance by Design

  • Align technical controls and reporting with sectoral regulations (PSD2, GDPR, etc.).
  • Use robust FIDO2 servers and lifecycle management for passkey generation, storage, and revocation.
  • Leverage secure enclaves, end-to-end encryption, and on-device key handling for data confidentiality and integrity compliance.[4]
Now Available On Demand Learn how BNP Paribas and Secfense deployed FIDO & Passkeys at scale

Key Takeaways for IAM and Security Leaders

  • Passwordless is a process, not a switch: Hybrid coexistence of old and new authentication is required especially in regulated, multi-system environments.
  • User experience is as critical as security: Adoption depends on balancing frictionless flows and highest security assurance.
  • No-code, agentless solutions like Secfense UASB supercharge velocity: They empower organizations to modernize IAM quickly, without waiting on slow and risky code changes or upgrades.
  • Compliance and auditability are foundational: Choose IAM upgrade paths and vendors with proven records meeting strict security and audit requirements.

Ready to Start Your Journey?

Migrating your IAM system to passkeys is a strategic move that will define your security posture for the years ahead. With Secfense, you can bridge old and new worlds enjoying the strongest, phishing-resistant authentication, seamless user experience, and regulatory peace of mind.

Contact Secfense today to schedule a demo or proof-of-concept and discover how your organization can become passwordless faster, safer, and simpler than you ever thought possible.

Keywords: identity and access management, identity and access management solutions, identity and access management tools, identity and access management system, identity and access management services, identity and access management vendors[7][8][5][3][2][1][4]

Sources

  1. https://secfense.com/blog/how-bnp-paribas-implemented-passkeys-at-scale/       
  2. https://www.kuppingercole.com/watch/banking-on-trust-lessons-eic25    
  3. https://www.darkreading.com/identity-access-management-security/passkey-usability-challenges-require-problem-solving    
  4. Hybrid Passwordless Authentication in Banking | Secfense
  5. https://www.corbado.com/blog/why-passkey-implementations-fail  
  6. https://devops.com/navigating-passkeys-challenges-pitfalls-and-considerations-for-developers/ 
  7. https://secfense.com/webinars/eic2025-bnp-paribas-passkeys/ 
  8. https://www.ubisecure.com/identity-platform/how-to-migrate-iam-system/ 
  9. https://ventureoutny.com/blog/ventureout-2020-cyber-alum-secfense-scores-a-big-one-with-bnp-paribas-bank-polska/ 
  10. https://x.com/secfense_team 
  11. https://www.ubisecure.com/identity-platform/how-to-migrate-iam-system-part-2/ 
  12. https://www.youtube.com/watch?v=1Nbixa4bgUk 

Featured Articles

Keep In Touch

Read More

Phishing-resistant MFA: The new compliance baseline

Cybersecurity regulations are converging on a clear message: phishing-resistant multi-factor authentication (MFA) is now the baseline for compliance. Whether you operate in financial services, critical…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 3 MIN

Passkeys in regulated industries: IAM compliance without passwords

Regulated industries such as banking, healthcare, and public administration face stringent identity and access management (IAM) requirements driven by regulations including PSD2, HIPAA, NIS2, and…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 4 MIN

Migrating IAM systems to support passkeys: challenges and solutions

Modernizing identity and access management (IAM) to enable passkeys is shifting from “nice to have” to a competitive necessity for enterprises. As identity-based attacks and…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 4 MIN

Testimonials

We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk

CEO

Sandis

We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director

RKKVC

Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera

Partner

Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures