Passkeys for business: start killing the password in Microsoft 365
Passkeys make stolen-password attacks useless — and Microsoft 365 supports them today. What passkeys are, why they beat MFA fatigue, and how to roll them out.
Passwords get stolen. Approval prompts get fatigued into submission. Passkeys are the first login technology that makes the standard phishing playbook simply not work — and Microsoft 365 supports them today.
Almost every business breach we investigate starts the same way: a credential. Phished, guessed, reused or bought. Multi-factor authentication raised the bar, but attackers adapted — fake login pages that relay codes in real time, and "MFA fatigue" attacks that bombard staff with approval prompts until someone taps yes. Passkeys close both doors.
What is a passkey, in plain English?
A passkey is a cryptographic key pair that lives on your device — your phone, laptop or a hardware security key — and unlocks with your fingerprint, face or PIN. When you sign in, the device proves it holds the key for that exact website. There is no password to steal, nothing to type into a fake page, and no code to relay.
The security property that matters: a passkey only works with the genuine site it was created for. A convincing fake login page achieves nothing, because the passkey will not respond to it. That is what "phishing-resistant" actually means.
Why are passkeys better than the MFA you already have?
Passkeys beat conventional MFA because they remove the human judgement step that attackers exploit. Nobody has to spot the fake page or resist the fifth approval prompt at 11pm — the technology refuses on their behalf. They are also faster: a fingerprint beats typing a password plus a six-digit code, so this is a rare security upgrade staff actively like.
How do you roll out passkeys in Microsoft 365?
You roll out passkeys in Microsoft 365 through Entra ID's authentication methods, and the sensible path looks like this:
Enable passkeys in Entra ID
Microsoft Authenticator can hold passkeys on staff phones, and hardware keys (like YubiKeys) suit shared or high-risk roles.
Pilot with a friendly group
a handful of staff register passkeys and live on them for a fortnight.
Register the whole team
a short, guided enrolment; most people are done in minutes.
Tighten policy over time
require phishing-resistant methods for admins first, then step down weaker factors for everyone as coverage grows.
Two details matter: keep a recovery path for lost devices (a second registered passkey or a temporary access pass), and make sure legacy authentication is fully off — there is no point fitting a vault door while a side window stays open.
Frequently asked questions
What happens if someone loses their phone?
Their passkey is protected by the phone's own biometrics or PIN, so the finder cannot use it. The person signs in via their backup method, the old passkey is revoked, and a new one is registered on the replacement device — a five-minute helpdesk job.
Do passkeys work for Macs, iPhones and Android together?
Yes. Passkeys are an industry standard (FIDO2/WebAuthn) supported across Apple, Google and Microsoft ecosystems, and they sync within each platform's credential manager.
Do we have to get rid of passwords entirely?
Not on day one. Most businesses run passkeys alongside existing MFA, then progressively require the stronger method — admins first, everyone eventually. The end state is passwordless; the path there is gradual.
Are passkeys enough security on their own?
They protect the login, which is the most-attacked point — but not the endpoint, the data or the humans. Passkeys belong inside a layered programme like our managed cybersecurity service, not instead of one.
Make the move
We run passkey rollouts as part of Microsoft 365 management — policy, enrolment, recovery paths and the legacy cleanup that makes it stick. One project, and the most common attack on your business stops working.
Related Key IT services
More insights
Microsoft's 2026 legacy login shutdown
Microsoft is disabling legacy authentication and Basic Auth across Entra ID in 2026. Here's how…
Read article →Microsoft 365Microsoft 365 plans compared
Business Basic, Standard or Premium? A clear comparison of Microsoft 365 plans for Melbourne…
Read article →Microsoft 3658 Microsoft 365 time-savers
Practical Microsoft 365 features most people miss — from Teams shortcuts to Outlook rules — that…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.