When an employee loses a security key, they switch to their backup key, you remove the lost key from every account it was registered to, and you issue a new backup. Do it in that order. One admin checklist from idarb.com is built to be finished in the first 30 minutes after a loss is reported.

Know this before you start: only removing the key disables it. A password reset leaves a FIDO2 key working as a sign-in method, as Sourcepass points out.

What you need

  • Admin rights in each identity provider and service the key touches

    You need enough access to remove an authentication method and end sessions.

  • Your key inventory

    Model, serial number, assigned user and activation date for every issued key, as Frontegg recommends.

  • A way to verify identity that does not depend on the lost key

    Examples are an HR record or a call back to a known number through established channels.

  • A replacement key from your approved procurement process
  • A temporary sign-in method, if no backup key exists

    In Microsoft Entra this is a Temporary Access Pass. In Google Workspace, recovery depends on backup codes saved beforehand.

The steps

  1. Get the loss details. Record when the employee last had the key, where, which model it was, and whether a laptop or phone went missing with it. You should end up knowing whether the key was misplaced or might have been stolen.

  2. Allow a short, limited search. AethoVPN suggests checking only the likely places: the computer's USB port, a pouch, a hotel safe, a meeting room, a security desk, and transport lost-and-found. If it turns up, you stop here.

  3. List every account the key is registered to. Combine your inventory with the employee's own list of admin portals, password managers and third-party services. Telling one service does nothing to protect the others. You should have a written list.

  4. Have the employee sign in with the backup key. It works if they reach their accounts without the lost key. If no backup exists, see the first question in the next section.

  5. Remove the lost key from each account on the list. In Microsoft Entra ID, Microsoft's guidance is to open the Security info page and remove the FIDO2 security key. It worked if the key no longer appears among that account's sign-in methods. Do not wait to do this. If the key was stolen and protected by a weak PIN, someone holding it is the risk the NCSC identifies.

  6. End active sessions on each account. The NCSC recommends forcing reauthentication once a key is removed. It worked if the employee has to sign in again.

  7. Verify the employee's identity through the independent channel. The NHI Mgmt Group explains why: whoever holds the old key should not be able to request a new one through the same channel.

  8. Have the employee register the replacement. In Entra, admins cannot register a key for a user. The employee does it, and the steps for enrolling a key in Entra are the same as at rollout. It worked when the new key shows up as a sign-in method.

  9. Update the inventory. Mark the old serial as lost, add the new one, and write down every change you made.

When there was no backup, or the removal didn't take

Verify their identity first (step 7). Then issue a temporary method, such as an Entra Temporary Access Pass, and have them register the new key with it. Do not hand them a password as the fallback. GSA's [Identity Lifecycle Management Playbook](https://www.idmanagement.gov/playbooks/ilm/) warns that a replacement can take days, weeks or months to arrive. It recommends an interim FIDO2 key or a syncable passkey instead. For federal workforces, OMB M-22-09 rules out SMS codes, authenticator-app codes, email codes and push prompts as backups.

In that case the whole tenant is locked. A [Microsoft Q&A thread](https://learn.microsoft.com/en-us/answers/questions/5417874/what-can-i-do-if-i-have-lost-my-fido-keys-to-my-m3) describes the route: open a request from a different tenant, such as a trial tenant or one belonging to a partner, through admin.microsoft.com, Help & support, Contact support. Ask for escalation to the Microsoft Data Protection Team. Expect to prove ownership with billing or subscription details, DNS records for the domain, and email tied to the account. This comes from a community answer, not Microsoft documentation, so treat it as a lead rather than a guaranteed process.

A FIDO2 key is a separate authentication method, and a password reset does not touch it. Remove the key itself (step 5).

Some sites still don't offer one. The NCSC names TikTok as an example. None of the sources here gives a workaround. Record the account as unresolved in your inventory and raise it with the service's support team.

Microsoft says FIDO2 keys protect the private key in a secure enclave, and anti-hammering protections stop it from being extracted. Frontegg adds that a lost key cannot be used remotely. The remaining risk is a person holding the key and guessing its PIN, which is why step 5 comes before everything else.

Stopping the next lockout

The employee now has a working replacement, and the lost key is dead on every account you could reach. GSA's phishing-resistant authenticator playbook says to keep at least two valid authenticators per user, because account recovery is itself an attack vector. Settle the right number of keys per person before the next loss forces the question.

How should backup keys be provisioned so no one gets locked out?

The deployment guide covers issuing and registering backup keys as part of rollout, so a lost key is a quick swap.

Read the deployment guide