CASE STUDY · IDENTITY & ACCESS MANAGEMENT (IAM)
Rolling out passwordless authentication across a 500-person enterprise.
- 92%92% adoption after 90 days
- 40%Password-reset tickets down 40%
01 · PROJECT OVERVIEW
The client and the brief.
An anonymised 500-person enterprise. Name withheld under confidentiality.
A phased rollout of passkeys with training and a fallback method. Passkeys became the default sign-in for staff. Authenticator apps and hardware keys covered the cases passkeys could not.
- 1The company had frequent password resets and a real phishing risk.
- 2Staff worked across laptops, phones and shared kiosks.
- 3The help desk spent a large part of each week unlocking accounts.
- 4Leadership had also seen phishing attempts get close, and wanted a sign-in method that could not be typed into a fake page.
02 · WHAT WENT WRONG
What went wrong, and how we fixed it.
Every engagement hits problems. These were the ones that mattered here, and what we changed so they did not come back.
- PROBLEM 01Shared kiosk machines on the warehouse floor could not hold personal passkeys
Our first wave assumed every user had a personal device. Those staff were locked into the old flow and tickets rose that week. We paused that group, issued hardware keys for the kiosks, and rewrote the guide for shared devices.
- PROBLEM 02We added a device-type check to the readiness list for every later wave
- PROBLEM 03A second problem showed up in week eight
A group of field staff used an older mobile browser that handled passkey prompts badly, and enrolment failed half way through. People gave up and called the help desk. We did not try to patch around it.
- PROBLEM 04We added a minimum browser and operating system check to the readiness list, sent a short update note to affected users and offered an authenticator app as a stopgap until their devices were updated
Tickets from that group fell back within two weeks.
03 · THE PROCESS
How we ran it.
The work ran over roughly 90 days in four phases.
- 01Step 1
Weeks 1 to 2: inventory of devices, browsers and apps. We found which apps supported modern sign-in and which did not.
- 02Step 2
Weeks 3 to 4: pilot with the IT team. We fixed enrolment friction and wrote the guides.
- 03Step 3
Weeks 5 to 9: department-by-department waves. Each wave started with a short briefing and a live session. We ran a help channel and a daily review of problems during the first week of every wave.
- 04Step 4
Weeks 10 to 13: tail of late adopters, shared devices and exceptions.
We met the client lead weekly and sent a one-page status after each wave.
04 · RESULTS
What changed.
Measured against the way the work ran before the engagement began.
- NOW 01
New joiners are enrolled with a passkey on day one, not given a temporary password.
- NOW 02
The help desk follows a written recovery script.
- NOW 03
IT reviews the remaining password-only apps each quarter and has a date to retire each one.
- NOW 04
Handover covered a runbook for enrolment, recovery and lost devices, a dashboard of sign-in methods by group, and a named owner for each remaining password-based app.
- 92%
92% adoption after 90 days
- 40%
Password-reset tickets down 40%
05 · WHAT WE BUILT
How it works.
- Enrolment tied to a verified session, so a new passkey cannot be added by someone who only knows a password.
- Conditional policies by device and risk, with stronger checks for admins.
- A fallback ladder: second device, hardware key, then help-desk identity check with logging.
- Password sign-in turned off per group once that group passed a readiness check.
06 · QUICK ANSWERS
The short version.
- What problem did the client have?
- The company had frequent password resets and a real phishing risk. Staff worked across laptops, phones and shared kiosks. The help desk spent a large part of each week unlocking accounts. Leadership had also seen phishing attempts get close, and wanted a sign-in method that could not be typed into a fake page.
- What did Brandsmashers build?
- A phased rollout of passkeys with training and a fallback method. Passkeys became the default sign-in for staff. Authenticator apps and hardware keys covered the cases passkeys could not.
- How was the work run?
- The work ran over roughly 90 days in four phases.
- What were the results?
- 92% adoption after 90 days; password-reset tickets down 40%.
YOUR TURN
Have a similar requirement?
Tell us what is stuck. We will come back with a plan and matched, pre-vetted engineers.
