Detections
Analytics

1.22.1 Ensure 'Enable saving passkeys to the password manager' is set to 'Disabled'

Information

This policy setting controls whether users can save passkeys in the built-in password manager.

The recommended state for this setting is: Disabled.

Note: If the PasswordManagerEnabled policy is disabled, saving to the built-in password manager is disabled in general, including passkeys. In that case, this policy has no effect.

Storing passkeys in the browser's built-in password manager places authentication credentials outside the organization's centralized credential management framework. Enterprise environments that manage authentication through platform-level solutions such as Windows Hello for Business or FIDO2 security keys should prevent the browser from becoming an additional, unmanaged credential store.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled :

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Password manager and protection\Enable saving passkeys to the password manager

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.

Impact:

Users will not be able to save new passkeys to the built-in password manager in Microsoft Edge. Previously saved passkeys continue to work. Users can still create and store passkeys through platform-level credential providers.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 5478f86ab8eb5f274909922f408e04babf1d894ee8ecbfe21a99ea44a668a0d3