Is my fingerprint or face sent anywhere?

Do biometrics leave my device?

No. Your fingerprint, face or PIN are checked by your own device (computer, phone or security key). They only unlock a key stored on that device. The service receives only a signature made with that key, never an image, a template or a digest of your biometrics.

The console puts it this way: «The device confirms your presence and signs the challenge. No biometric image leaves this device.»

Does the service know which finger I used?

No. The service only knows the device confirmed a local check. The phone's details show only the kind of confirmation required, for example «Biometrics or the phone PIN».

Can I use a PIN instead of biometrics?

Yes, if the device and your organization's policy allow it. The passkey and the phone accept the unlock the system offers: biometrics, PIN or pattern.

What happens if I add a new fingerprint?

If your organization requires biometrics only to approve, Android invalidates the approval key when biometrics change. This is a protection: nobody can add their own fingerprint and approve as you. You will have to link the account again; see The approval key is no longer valid.

Does my organization see biometric data?

No. Neither your organization nor the service provider has access to biometric data, because that data is never received.