# How To Set a Network Passkey-only Policy With BetterShield?

Require selected roles to sign in with passkeys across the network after every affected site has a recovery path.

In **[BetterShield](/)**, use **Network Admin › BetterShield › Network › Set once, for every site › Passkey-only roles across the network**.

## What it does

The policy offers **Administrator**, **Editor**, **Author**, **Contributor**, and **Subscriber**, with no role selected by default. Selected roles sign in with a passkey instead of a password on every site. Each site can add roles but cannot remove a network-required role.

Adding a role is refused when any site lacks a working recovery link or printed recovery codes. It is also refused on networks with more than 200 sites. The main site's audit opens a medium finding when sites under the policy later lack a recovery path.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Set a Network Passkey-only Policy

Prepare recovery on every site, ensure affected people have passkeys, tick roles, and select **Save**.

<figure class="doc-shot">
  <img src="/docs/screenshots/network-passkey-policy.png" alt="Network passkey-only policy with role checkboxes and Not set status." width="1960" height="364" loading="lazy" decoding="async">
  <figcaption>The policy starts unset and checks network recovery readiness before it can add a role.</figcaption>
</figure>

## Recommended settings

Start with a small administrative group. Verify at least two usable recovery methods before extending the policy.

## What it can break and how to undo

People without a usable passkey can be unable to sign in. Use the network recovery link if necessary, then restore the earlier role policy from network history or deselect roles and save.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

An affected account should be directed to passkey sign-in on each site. A site administrator should be unable to weaken the network-required role.

<figure class="doc-shot">
  <img src="/docs/screenshots/network-passkey-policy.png" alt="Network passkey-only policy with role checkboxes and Not set status." width="1960" height="364" loading="lazy" decoding="async">
  <figcaption>Example Network passkey-only policy view. Check the saved values and status on your own site.</figcaption>
</figure>

## Related

- [Two-factor and passkeys](/docs/two-factor-and-passkeys/)
- [Use the network recovery link](/docs/network-recovery-link/)
- [Review network settings history](/docs/network-settings-history/)

This is how you can set a network passkey-only policy with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).