Sign-in & directories

Passkeys

Signing in with a fingerprint, Face ID or the device PIN instead of a password — allowed, not allowed or required, as your organisation decides.

With a passkey you sign in without a password: you confirm with your device's fingerprint reader, Face ID or PIN. The key stays on the device — DDM only knows its public half. It can be neither guessed nor phished on a fake page.

A passkey is the device in your hand and your fingerprint or PIN in one. So after signing in with a passkey, DDM asks for no two-factor code — also where your organisation requires one.

Setting one up

In the CMS, click your name at the bottom left and open My account.
Under Passkeys, click Add passkey.
Your device asks for your fingerprint, Face ID or PIN. Confirm.

The passkey appears in the list, named after the device — Mac, iPhone, Windows … Use the pencil icon to give it a name of your own, such as Office laptop.

Set one up on each device you sign in with. A passkey in iCloud Keychain or Google Password Manager reaches your other devices too; the list then says synced.

You add a passkey from a session at most a day old. Otherwise, sign out and in again first.

Signing in

On the sign-in page, click Sign in with a passkey and confirm on your device. No e-mail address needed. Many browsers also suggest the passkey as soon as you click the E-mail field.

In the app, Sign in with a passkey is among the sign-in buttons:

In the browser and in the desktop app on Windows, the device asks directly.
In the app on a phone, the phone's browser opens briefly; once you confirm, you're back in the app.
The desktop app on macOS and Linux has no such button — sign in there as before.

In the app, manage your passkeys under Settings › Passkeys: the page opens in the browser.

Lost device

Remove the passkey under My account › Passkeys with the bin icon. Delete it on the device or in your password manager too, if you still can.
If you can no longer get in, ask an administrator of your organisation: under Users › your name › Remove passkeys they remove all of your passkeys. Sessions a passkey opened end at once. You then sign in with your password. Only another owner removes an owner's passkeys.

For the organisation

Under Settings › Security › Passkeys (fingerprint, Face ID), administrators decide what applies:

Setting	What it does
Allowed	The default. Everybody may set up a passkey; the password keeps working.
Not allowed	Passkeys cannot be set up, and nobody signs in with one they have. Whoever is signed in with a passkey right now is signed out. The app no longer offers unlocking with Face ID or fingerprint either.
Required	Whoever has no passkey yet is asked for one at their next step — in the CMS or the app — and can only carry on after that. Once somebody has one, the password alone no longer opens the account. Nobody can remove their last passkey without adding another first.

If you require passkeys without having one yourself, DDM takes you straight to setting one up.

Somebody who works for several organisations is held to the strictest rule: if one of them does not allow passkeys, that person cannot sign in with one anywhere.

Whoever signs in through your single sign-on is not affected — your identity provider decides there. Platform operators keep their password.

Under Users, each person's details show how many passkeys they have. The audit log records when somebody adds or removes one — or an administrator removes them.

Two-factor authentication

After the password, a code from an authenticator app – optional for everybody, required for your organisation if you decide so, with codes by e-mail as a fallback you can switch off.

Calendar access

Connect everybody's calendar automatically — once for the whole organisation, with Microsoft 365 or Google Workspace.