HID Global is tackling the last mile of enterprise passkey adoption head-on with a new management service and refreshed hardware line. On August 5, the company unveiled Enterprise Passkey Management (EPM), a subscription-based control plane, alongside a family of FIDO-certified Crescendo authenticators. The move targets the operational friction that has kept even enthusiastic enterprises from scaling phishing-resistant sign-ins across hybrid workforces.

Fresh data from the FIDO Alliance underscores the appetite: 87% of enterprises in the US and UK are now either deploying or planning passkeys for employee sign-ins. Yet the same research cites complexity and cost as the top obstacles for the holdouts. HID’s twin product launch aims squarely at both—delivering modern FIDO2 hardware and the centralized tooling needed to provision, manage, and audit credentials at scale.

The announcement signals a deeper industry shift. Passkeys are no longer experimental; they are production-grade, and vendors are racing to wrap them in enterprise-grade operations. For Windows shops anchored on Microsoft Entra ID, HID’s bundle offers a tangible path from pilot to full rollout.

What’s in the Box: Hardware Meets Management

HID’s August lineup spans four components, each designed to close a different gap in the passkey lifecycle.

Enterprise Passkey Management (EPM)

EPM is the subscription service that acts as the operational backbone. It focuses on at-scale management rather than just initial issuance:

  • Remote provisioning: Administrators can issue FIDO credentials on behalf of users, slashing the training burden during onboarding.
  • Full lifecycle oversight: Centralized visibility covers issuance, revocation, and audit trails—essential for meeting security baselines and generating compliance evidence.

In practice, EPM tackles the bottlenecks that have stymied enterprise adoption, from first-time enrollment to credential replacement and audit readiness. By abstracting the complexity of mixed hardware fleets, it gives identity teams a single pane of glass.

Crescendo Keys

The redesigned Crescendo Keys emphasize ergonomics and accessibility while supporting a tri-stack of FIDO2, PKI, and OATH. This makes them suitable for both modern passwordless flows and legacy certificate-based systems. HID highlights remote PIN reset and device unlock options as key to keeping users productive without risky workarounds. The keys are FIDO 2.1 certified and come in USB-A and USB-C form factors.

Crescendo Cards

For organizations that want to merge building access with digital logins, Crescendo Cards serve as a unified corporate badge. They integrate physical access technologies (Seos or MIFARE DESFire EV3) with FIDO2 for passwordless authentication. Variants support dual-interface or contactless formats, and HID explicitly calls out FIDO 2.1 support. This convergence reduces badge sprawl and simplifies the user experience—one credential for doors and data.

OMNIKEY 5022 Contactless Reader

Rounding out the hardware is the OMNIKEY 5022, a compact USB reader for desktops and shared kiosks. It supports FIDO2/NFC credentials and connects to standard Windows workstations without additional drivers, thanks to its CCID class compliance. That makes it ideal for thin-client and frontline environments where users tap their cards to sign in.

Why This Matters for Windows and Entra ID

Microsoft has steadily matured passkey support inside Entra ID. Once enabled for a user or group, FIDO2 security keys enable passwordless sign-in across Windows 10/11, web apps, and the Microsoft 365 stack. Admins can enforce attestation to restrict acceptance to specific key models, and Microsoft ingests the FIDO Alliance Metadata Service (MDS) monthly to keep its recognized list current.

HID’s portfolio plugs directly into that ecosystem. Pairing Crescendo keys or cards with Entra ID means employees can log into their Windows machines and cloud resources with a single hardware token—no passwords, no SMS codes. And because the credentials are device-bound, they are immune to phishing and AitM attacks.

The company has also deepened its ties with Microsoft by supporting Entra ID’s External Authentication Methods. This feature lets businesses leverage existing physical access cards as a multi-factor authentication (MFA) factor, paving a gradual road to full passwordless. In phased rollouts, that flexibility is invaluable: different cohorts can adopt FIDO hardware, synced passkeys, or certificate-based logon at their own pace.

Four Strengths Enterprises Should Note

  1. End-to-end operations: EPM isn’t a lab toy. Its remote provisioning and lifecycle tooling are built for real-world scale, with delegated admin roles and automated workflows.
  2. Form-factor flexibility: From keys for roaming executives to cards for badged employees and a low-cost desktop reader, HID covers the span of user personas—including frontline and shared-device workers.
  3. Windows-native experience: Entra ID and Windows 10/11 provide first-class passkey handling, including attestation controls, group-based enablement, and seamless integration with Conditional Access.
  4. Physical-logical convergence: Seos and DESFire EV3 card options with FIDO mean one badge grants both office access and digital login—a simplification that cuts costs and security risks.

The Hard Questions: Caveats and Prep Work

For all the promise, a few realities demand upfront planning.

Subscription economics: EPM is a subscription. Organizations must model the total cost—hardware, management licenses, and reader infrastructure—against alternatives like synced passkeys or certificate-based MFA. While the management layer may reduce help-desk tickets, the full TCO needs close scrutiny.

Attestation and compatibility: If your tenant enforces attestation, you must confirm that HID models appear in Microsoft’s recognized list. There can be up to a four-week lag between an MDS update and Entra ID recognition, so plan timelines accordingly. Validate AAGUIDs in a test tenant before piloting.

Recovery planning: Device-bound passkeys are intentionally non-recoverable. Lost or damaged keys mean lost access unless a backup credential exists. HID recommends issuing at least two credentials per user and documenting break-glass procedures for admins. Microsoft’s documentation and HID tools support PIN resets and re-registration, but rigorous process design is essential.

Reader dependencies: Card-based FIDO on desktops hinges on NFC/USB readers. Test the OMNIKEY 5022’s placement, CCID driver baselines, and performance on thin clients before broad deployment. In some cases, keyboard-embedded readers or USB hub topologies may introduce interference.

A Windows Admin’s 7-Day Pilot Blueprint

Translating the announcement into action, here is a concentrated pilot roadmap drawn from Microsoft’s guidance and HID’s documentation:

  1. Enable passkeys in Entra ID: In the Entra admin center, turn on Passkey (FIDO2) for a pilot group. Minimum Windows versions: 1903 for Azure AD-joined and 2004 for hybrid-joined devices.
  2. Pick your form factors: Start with Crescendo Keys for IT admins and high-risk users. Use Crescendo Cards plus the OMNIKEY 5022 for shared PCs or badged facilities.
  3. Stand up EPM: Configure remote issuance, assign admin roles, and define revocation and audit policies that align with identity governance controls.
  4. Validate attestation: If enforcing attestation, check HID AAGUIDs in a test tenant and confirm they surface in Entra’s recognized catalog after MDS synchronization.
  5. Provision two credentials per user: Issue a primary and a backup to avoid lockouts. Document PIN-reset and re-registration steps.
  6. Integrate with Microsoft 365: Test sign-in flows for Outlook, Teams, and admin portals. Verify that Conditional Access policies behave as expected for passkey sessions.
  7. Prepare the help desk: Script standard operating procedures for lost/stolen credentials, re-issuance, and audit exports. Capture pilot metrics—help-desk ticket volume, MFA prompt rates, and user satisfaction—to quantify ROI.

The Broader Passkey Moment—and HID’s Place in It

Industry momentum is unmistakable. Organizations consistently report stronger security, better user experiences, and fewer help-desk calls after moving to passkeys. Yet the transition is messy: teams juggle device-bound and synced models, navigate legacy infrastructure, and struggle to maintain visibility across heterogeneous fleets.

HID’s contribution is operational harmony. By wrapping diverse FIDO hardware in a single management layer and converging physical and logical access, it aims to smooth the hardest parts—enrollment, fleet operations, and audit readiness. That’s a practical answer to the question many identity architects have been asking: “How do we manage this at scale?”

Windows and Entra ID shops now have a vendor-supported blueprint. With attestation guardrails, subscription economics, and backup strategies planned upfront, the promise of phishing-resistant authentication can finally move from boardroom slide decks to daily login screens.

As the FIDO Alliance research signals, the passkey era is already here. The differentiator will be who can manage it best.