Biometric protection
What it does
Section titled “What it does”A biometric-protected key requires Touch ID, Face ID or the device passcode every time it is used — connecting to a server, or signing an agent-forwarding request.
What it changes about sync
Section titled “What it changes about sync”Protected keys are deliberately device-local:
- They are excluded from iCloud Keychain sync.
- To use one on another device, re-import it there or transfer it with Key Handoff.
This is a security feature: your most sensitive keys never leave the hardware you enrolled them on.
Enabling protection
Section titled “Enabling protection”Turn on protection for a key in the key library. The requirement applies immediately to every profile that uses the key.