One accountable person
The primary identity remains the clear owner of every additional role and certificate.
MULTI-IDENTITY YUBIKEY MANAGEMENT
One physical key can carry several clearly separated identities.
SYNRION x.ID keeps every certificate, role and application context connected to the accountable primary identity. Depending on hardware version and cryptography, up to 23 secondary identities can be managed on one YubiKey.
VALUE IN 30 SECONDS
Fewer physical keys without mixing responsibilities.
Separated use cases
Administrative tiers, domains and application roles remain distinct even when they share one hardware carrier.
Independent lifecycles
A secondary identity can be issued, renewed or removed without turning the whole device into an unmanaged exception.
ONE CARRIER · CONTROLLED IDENTITIES
How do several identities share hardware without sharing trust?
The answer is not to treat the YubiKey as one global identity. x.ID models the person, each secondary identity, its certificate and its permitted use as separate but connected objects.
-
01
Anchor the primary identity
Begin with the verified person who is accountable for the hardware and every secondary identity assigned to it.
-
02
Define roles and trust boundaries
Create secondary identities for distinct administration tiers, domains, forests, applications or operational duties.
-
03
Assign suitable PIV slots
Place each supported certificate identity in a controlled slot and keep the mapping visible to administrators and auditors.
-
04
Enforce issuance policy
Check hardware evidence, identity, role and required approvals before each secondary identity becomes active.
-
05
Maintain every assignment in the target directory
Set the certificate and strong mapping for each identity in its intended AD or Entra context instead of documenting only the token slot.
-
06
Operate each identity deliberately
Renew, suspend or remove the affected identity while preserving the remaining approved roles on the same key.
THE ARCHITECTURE AT A GLANCE
One carrier does not mean one undifferentiated trust context: each secondary identity remains linked to its own role, certificate, policy and lifecycle.
TECHNICAL DEPTH
Capacity is a design decision, not a blanket promise.
The physical device can consolidate credentials, but the usable arrangement must be planned against hardware, cryptography, applications and organizational separation rules.
- Up to 23 secondary identities
- In a suitable configuration, x.ID can manage a primary identity and up to 23 secondary identities on one YubiKey. The actual number depends on hardware version, cryptographic algorithms, certificate sizes, slot allocation and policy.
- PIV slots
- The PIV application provides defined certificate and key slots. x.ID keeps the intended identity and application context visible instead of relying on an administrator to remember a slot convention.
- Role separation
- Using one carrier does not remove the need for tier, domain and duty separation. Each identity can have independent issuance rules, approvals, validity and removal.
- FIDO2 remains a separate use case
- FIDO2 credentials and PIV certificate identities use different protocols and lifecycle objects. A shared physical key does not make them technically interchangeable.
- Assignments in AD and Entra
- Multiple identities require more than separate slots: every target assignment must remain correct. x.ID combines the LDAP path for userCertificate and X509:
with the native Azure Connector path for Microsoft Entra ID.
EVIDENCE & BOUNDARIES
What remains controllable when identities are consolidated.
The important result is not the maximum slot count. It is the ability to reduce hardware while keeping every identity understandable and changeable.
Identity-to-slot assignment
Administrators can see which secondary identity, certificate and use case belong together.
Policy per identity
Approval and lifecycle rules can differ by role, tier, domain or application context.
Controlled removal
A role can be removed without automatically discarding all remaining identities on the hardware.
Target systems remain consistent
Removed or renewed identities are deliberately reconciled in their AD and Entra assignments as well.
RELATED PRODUCT
SYNRION x.ID
SYNRION x.ID combines verified primary identities, authentic hardware and independent policy enforcement into one reliable trust decision.
THE NEXT CONTROLLED STEP
Map your roles before buying one key per identity.
We will examine your tiers, domains, applications and separation rules and show which identities can share hardware without losing control.