How To Set a Network Passkey-only Policy With BetterShield?
Require selected roles to sign in with passkeys across the network after every affected site has a recovery path.
In BetterShield, use Network Admin › BetterShield › Network › Set once, for every site › Passkey-only roles across the network.
What it does
The policy offers Administrator, Editor, Author, Contributor, and Subscriber, with no role selected by default. Selected roles sign in with a passkey instead of a password on every site. Each site can add roles but cannot remove a network-required role.
Adding a role is refused when any site lacks a working recovery link or printed recovery codes. It is also refused on networks with more than 200 sites. The main site’s audit opens a medium finding when sites under the policy later lack a recovery path.
Step 1: Set a Network Passkey-only Policy
Prepare recovery on every site, ensure affected people have passkeys, tick roles, and select Save.
Recommended settings
Start with a small administrative group. Verify at least two usable recovery methods before extending the policy.
What it can break and how to undo
People without a usable passkey can be unable to sign in. Use the network recovery link if necessary, then restore the earlier role policy from network history or deselect roles and save.
Final Outcome
An affected account should be directed to passkey sign-in on each site. A site administrator should be unable to weaken the network-required role.
Related
This is how you can set a network passkey-only policy with BetterShield.
Getting Stuck? Feel free to contact our Dedicated Support Team.