Andrew Cameron

General Motors enabled passkeys for about 100,000 employees, primarily through one move: Windows Hello stopped being optional. The passkey was the managed Windows device they already had. Andrew Cameron has spent 25 years in identity at GM, and on the latest Entra.Chat the Distinguished Engineer for Identity and Cybersecurity walked me through the playbook for all ~200,000 people. The clock is real: Microsoft makes passkeys the default on 1 September 2026 and retires its SMS and voice MFA on 1 February 2027. What worked at GM: → Windows Hello was the single biggest lever: set a PIN on a managed device and it registers as a passkey. Platform SSO extends the same idea to Mac. → Privileged roles went first: device-bound passkeys for admins, with Azure PIM forcing the stronger method at activation. → Conditional Access ran the rollout. Small pilot group, audit mode, add apps, expand. Targeting the big apps often hits 80% coverage faster than chasing every user. → The hard corners: factory floors with no phones and no keyboards, call centres on unmanaged devices, and several hundred thousand guests who can only finish a passkey sign-in if their own tenant enables passkeys too. And the roadblock that caught GM by surprise had nothing to do with passkey tech. Turn off SMS and you have also turned off the way every new hire signs in on day one. The new-phone recovery flow, same trap. Andrew explains how they fixed both in the episode. If your deprecation plan is "we'll deal with it in February," this episode is your head start. 🎧 entra.news/p/how-general-mot… #MicrosoftEntra #EntraID #Passkeys