> For the complete documentation index, see [llms.txt](https://docs.peig.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peig.io/welcome-to-peig-documentation/faqs.md).

# FAQs

## General

<details>

<summary>What is Peig?</summary>

Peig is a device-bound access security platform. It ensures that access to your business applications is tied to a specific, authorised device — replacing passwords entirely with cryptographic device identity. See \[What is Peig?]\(introduction/README.md) for a full explanation.

</details>

<details>

<summary>Does Peig replace my identity provider?</summary>

For Microsoft 365 and Google Workspace, Peig becomes the identity provider for your domain through SAML federation — replacing password-based authentication entirely. It is better understood as an alternative to credential-based authentication rather than a layer added on top of it.

</details>

<details>

<summary>Do users still need passwords?</summary>

No. After federation is set up, users no longer use passwords to access connected services. Their registered device handles authentication. There is nothing to remember, reset, or share.

</details>

<details>

<summary>Is Peig the same as MDM?</summary>

No. MDM manages and controls devices. Peig controls which devices can access your workspace — without managing those devices. It works on personal and BYOD devices without installing management software or giving IT visibility into the device itself. See \[Why Not MDM?]\(introduction/why-not-mdm.md) for a full comparison.

</details>

## Devices

<details>

<summary>What devices are supported?</summary>

Peig is available on macOS, Windows, iOS, and Android.

</details>

<details>

<summary>Can a user have more than one registered device?</summary>

Yes. Users can register additional devices using the device sync flow — both devices must be physically present. The user authorises the new device from their already-registered one. The Access Admin is notified when a new device is added.

</details>

<details>

<summary>What happens if a user loses their device?</summary>

If the user has another registered device, they can sync their new device from it without admin involvement. If they have no other devices, they initiate a re-approval request from their new device. The Access Admin verifies their identity and approves the request — access is re-established from the new device and all previous device records are removed. See \[Managing Devices]\(admin-guide/managing-devices.md).

</details>

<details>

<summary>Can I suspend a single device without blocking the user entirely?</summary>

Yes. Devices can be suspended individually without affecting the user's other registered devices or their account.

</details>

## Security

<details>

<summary>What happens if a registered device is stolen?</summary>

Suspend the device immediately in Users & Access. Access from that device is revoked instantly. The user's other devices are unaffected. If the user has no other devices, they can initiate a re-approval request from a new device.

</details>

<details>

<summary>Can someone access Peig-protected services by stealing a session token?</summary>

No. Session tokens issued by Peig are bound to the device that initiated the session. Replaying a token from a different, unregistered device will not grant access.

</details>

<details>

<summary>Does Peig work if the user is on a different network or location?</summary>

Yes. Peig's access model is not based on network location. Access is verified based on device identity regardless of where the user is connecting from.

</details>

<details>

<summary>Can a device's cryptographic identity be copied to another device?</summary>

Peig includes static and dynamic anti-copy mechanisms to detect and prevent this. Static mechanisms use hardware-level device identifiers. Dynamic mechanisms use cryptographic registers that change with every use and must align between the Peig client and server — if a key were extracted and replayed from another device, the registers would fall out of sync and the attempt would be detected. The Access Admin is notified immediately. See \[Cryptography and Protocol]\(security/cryptography-and-protocol.md).

</details>

## Microsoft 365

<details>

<summary>What Microsoft 365 license is required?</summary>

The admin account must have a Microsoft 365 Business Premium license, which includes Azure AD Premium P1 required for SSO and user provisioning. Other users can use lower-tier licenses such as Microsoft 365 Business Basic.

</details>

<details>

<summary>Can users still use Outlook, Teams, and other desktop apps?</summary>

Yes. For native desktop applications, Peig generates a short-lived authentication code that is automatically copied to the clipboard. The user pastes it into the application when prompted.

</details>

<details>

<summary>What if a user's email address is different in Peig and Microsoft 365?</summary>

This is handled through the MS365 Identifiers tool, which allows you to manually link accounts across the two systems even when their identifiers do not exactly match. See \[Managing MS365 Identifiers]\(deployment/microsoft-365/managing-identifiers.md).

</details>