Admins have heard plenty of "passwordless" promises before. Here's what Intercede says the product does, which parts are only the vendor's claims, and what Windows shops should check before booking a demo.
What Intercede announced
Intercede describes the product as two things. Investing.com, working from the company's press release, reports that MyID Authenticate functions as both a FIDO authentication server and a passkey issuer. In plain terms, it verifies passkey sign-ins and also issues passkeys to users. Intercede's market pitch is that it can extend passkey authentication beyond web applications to Windows desktops, cloud services, on-premise applications, and VPNs.
The main claims from the announcement and Intercede's product page:
- Authenticators: It supports FIDO2 security keys, device-bound and synced passkeys, with self-service enrollment. The product page says each user can enroll up to 10 devices.
- Windows logon: TipRanks' summary of the announcement lists Windows 10 and 11 logon including offline use. Intercede's product page says the desktop agent caches credentials in an encrypted form for offline logon. It also says the agent locks the session when the security key is removed and picks the right user automatically when a FIDO key is inserted.
- Federation: SAML 2.0 and OpenID Connect connect cloud and on-premises apps. The product page lists federation with Microsoft Entra ID and Microsoft 365.
- Legacy and network access: It supports RADIUS through Windows Network Policy Server (NPS) and FreeRADIUS. Intercede says it works with any RADIUS-compliant VPN or network device, but publishes no compatibility list of named VPN products.
- Deployment: The solution can be deployed on-premise, in the cloud or hybrid, and its crypto-agile design supports post-quantum cryptography.
- Migration: It integrates with existing MyID® MFA customers via a migration tool. It also works with MyID CMS, Intercede's system for issuing high-assurance credentials such as PKI smart cards.
Summary: On paper, one product covers the Windows desktop, federated apps and RADIUS-connected VPNs. That breadth is the selling point.
The Windows angle
This is the part Windows admins should care about. Passkeys for web sign-in are now mainstream. Getting the same credential to work at the Windows lock screen, on a laptop with no network, and on an old VPN concentrator is a different job. Intercede says it solves that with a Windows 10/11 desktop agent, an on-premises authentication server and RADIUS integration.
The server side sits on familiar Microsoft infrastructure. According to Intercede's specification page:
| Component | Vendor-stated requirement or option |
|---|---|
| On-prem server OS | Windows Server 2022 or 2025 |
| Database | SQL Server or PostgreSQL, using a dedicated MyID Authenticate database |
| Installer | PowerShell-based, run interactively or scripted |
| Scale-out | Optional load balancer in front of the authentication servers |
| Logging | Event codes written to the Windows Event Log |
| Cloud hosting | AWS, Azure, private cloud and others |
| Directory | None required; users provisioned via SCIM or from Active Directory or another source |
The directory point matters. Intercede says the product keeps user information in its own database and does not depend on any one directory or identity provider. Some organisations will like that for data-sovereignty reasons. Others will see one more identity store to secure, back up and keep in sync.
Intercede's Microsoft claims stop at federation with Entra ID and Microsoft 365. Nothing in the material shows that Microsoft endorses the product or that it integrates with Windows Hello for Business. As general industry background, Microsoft already offers its own FIDO2 security key and passkey sign-in for Entra-joined and hybrid-joined Windows devices. Before adding another vendor, Microsoft-first shops should compare the two on offline behaviour, RADIUS coverage and where the data lives.
Summary: The Windows stack (Server 2022/2025, SQL Server, PowerShell, NPS, Event Log) will feel familiar to Microsoft shops. The Entra relationship is federation only, not a native partnership.
Read the fine print on "phishing-resistant"
Intercede's launch copy says each passkey is tied to the genuine website, and its private key remains on the user's device; there is no shared secret for attackers to steal or replay. The origin-binding part is true of FIDO in general. The claim that the key never leaves the device needs a caveat. A FIDO Alliance enterprise white paper explains that synced passkeys use the operating system or a third-party sync service to copy cryptographic keys across a user's devices. By contrast, hardware security keys create device-bound passkeys that never leave the key. MyID Authenticate supports both, so the "never leaves the device" claim applies only to the device-bound setup.
That affects policy. The same FIDO paper says that on shared devices using a single account, passkeys tied to the platform or a credential manager are a poor fit, and recommends hardware-bound keys there. It also advises giving each user two hardware keys so they have a backup.
Also, Intercede's product page lists more than passkeys. It also offers mobile push with biometrics and fatigue protection, OATH TOTP, YubiKey and OneSpan Digipass tokens, a pattern grid, and one-time codes by SMS or email. Those methods help with legacy systems, but SMS and email codes are not phishing-resistant. In this kind of deployment, your security depends on the weakest method you allow, not on what the product supports. If you deploy it, restrict the weaker methods to the systems that truly need them.
Summary: Passkeys resist phishing; a platform that also offers SMS codes is only as strong as the methods you allow.
The post-quantum claim
Intercede calls the product "crypto-agile" and "post-quantum ready." Its own blog post on the launch is headlined Phishing-resistant today. Quantum-ready tomorrow. The public material does not name any post-quantum algorithm, implementation or certification. "Designed to support" post-quantum cryptography is a plan for the future, not proof of what a deployment uses today. Procurement teams with post-quantum requirements should ask exactly which algorithms are used and in which parts of the product.
Customers and the GovWare debut
There's a small inconsistency in the customer claims. Intercede's investor announcement says the product is launching with a major European public-sector digital services organisation as its lead customer. The SecurityInformed version says Intercede has won its first new-logo customer in Germany, meaning a brand-new client, for the combined MyID CMS and Authenticate solution. These may be the same organisation, but neither version names the customer or says how large the deployment is.
The international debut is at GovWare 2026 in Singapore. Intercede will show Passkey Windows Logon, offline sign-in and migration from MyID® MFA from 13 to 15 October 2026 at the Sands Expo and Convention Centre. It will be on its own stand, M38, and on DT Asia's stand, M31, with Swissbit. A trade-show demo is useful, but it is not an independent security assessment. No independent test results, detailed 2026.1 release notes or pricing had been published at launch.
The Windows 10 caveat
Supporting Windows 10 helps organisations with mixed fleets, but it doesn't make Windows 10 safe to run. Mainstream Windows 10 editions reached end of support on 14 October 2025, a year before this launch. Without Extended Security Updates they no longer get regular security patches; LTSC and IoT editions follow their own lifecycle dates. Putting phishing-resistant sign-in on an unpatched PC is like fitting a deadbolt to a door with a broken frame. Check your edition's support status first.
A short evaluation checklist for admins
If MyID Authenticate is on your shortlist, these questions come straight from the gaps in the public material:
- Offline policy: How long do cached offline credentials last, and how do you revoke a lost key on a laptop that hasn't connected for days?
- Synced passkey controls: Can you limit which passkey providers or authenticator models users can register?
- Allowed methods: Can you block SMS and email codes per application or user group?
- Entra ID federation: How does it fit with your Conditional Access policies and authentication-strength requirements?
- RADIUS: Has it been tested with your specific VPN, especially where NPS extensions are already installed?
- Migration from MyID MFA: Intercede says the migration is done with help from its specialists. Ask whether enrollments and policies carry over, and how much downtime to expect.
- Recovery: What is the account-recovery process, and does it bring back a phishable fallback such as SMS codes?
Bottom line
MyID Authenticate goes after a real problem: getting passkeys working at the Windows lock screen and on legacy systems. A Windows Server, SQL Server and PowerShell footprint will appeal to Microsoft shops that want to keep authentication on-premises. For now, though, the capability, customer and post-quantum claims are all Intercede's own, and none have been independently checked. Run a pilot, enforce strict rules on which methods are allowed, and confirm your Windows 10 machines are still supported before your users touch the new lock screen.