Passkeys for business: start killing the password in Microsoft 365
Passkeys for business make phished passwords and relayed MFA codes useless, and every Microsoft 365 business plan supports them. A plain-English rollout guide.
Passwords get stolen. Approval prompts get fatigued into submission. Passkeys are the first login technology that makes the standard phishing playbook simply not work — and Microsoft 365 supports them today.
One of the most common ways into a business is still a login: a password that was phished, guessed, reused from another breached site, or bought on the dark web. Multi-factor authentication raised the bar, but attackers adapted — flawless AI-written phishing emails that lead to fake login pages relaying codes in real time, and "MFA fatigue" attacks that bombard staff with approval prompts until someone taps yes. Passkeys close both doors.
What is a passkey, in plain English?
A passkey is a passwordless, phishing-resistant way to sign in: a cryptographic key pair that lives on your device — your phone, laptop or a hardware security key — and unlocks with your fingerprint, face or PIN. When you sign in, the device proves it holds the key for that exact website. There is no password to steal, nothing to type into a fake page, and no code to relay.
The security property that matters: a passkey only works with the genuine site it was created for. A convincing fake login page achieves nothing, because the passkey will not respond to it. That is what "phishing-resistant" actually means.
Why are passkeys better than the MFA you already have?
Passkeys beat conventional MFA because they remove the human judgement step that attackers exploit. Nobody has to spot the fake page or resist the fifth approval prompt at 11pm — the technology refuses on their behalf. They are also faster: a fingerprint beats typing a password plus a six-digit code, so this is a rare security upgrade staff actively like.
How do you roll out passkeys in Microsoft 365?
You roll out passkeys in Microsoft 365 through Entra ID's authentication methods, and the sensible path looks like this:
Enable passkeys in Entra ID
Microsoft Authenticator can hold passkeys on staff phones, and hardware keys (like YubiKeys) suit shared or high-risk roles.
Pilot with a friendly group
a handful of staff register passkeys and live on them for a fortnight.
Register the whole team
a short, guided enrolment; most people are done in minutes.
Tighten policy over time
require phishing-resistant methods for admins first, then step down weaker factors for everyone as coverage grows.
Two details matter: keep a recovery path for lost devices (a second registered passkey or a temporary access pass), and make sure legacy authentication is fully off — there is no point fitting a vault door while a side window stays open.
Frequently asked questions
What happens if someone loses their phone?
Their passkey is protected by the phone's own biometrics or PIN, so the finder cannot use it. The person signs in via their backup method, the old passkey is revoked, and a new one is registered on the replacement device — a quick helpdesk job, not a crisis.
Do passkeys work for Macs, iPhones and Android together?
Yes. Passkeys are an industry standard (FIDO2/WebAuthn) supported across Apple, Google and Microsoft ecosystems, and they sync within each platform's credential manager.
What does passwordless login mean for a business?
Passwordless login means staff sign in with a device they hold plus a fingerprint, face or PIN, instead of typing a password that can be phished or reused. In Microsoft 365 that typically means a passkey in Microsoft Authenticator, Windows Hello on a work laptop, or a hardware security key for shared and high-risk roles.
Do we have to get rid of passwords entirely?
Not on day one. Most businesses run passkeys alongside existing MFA, then progressively require the stronger method — admins first, everyone eventually. The end state is passwordless; the path there is gradual.
Does a passkey count as phishing-resistant MFA?
Yes. A passkey is multi-factor in a single step — the device holding the key plus your fingerprint, face or PIN — and because it only answers the genuine site, it cannot be phished or relayed. That matters for compliance too: the Essential Eight expects phishing-resistant MFA from Maturity Level Two.
Do we need a special Microsoft 365 licence for passkeys?
No. Passkeys are a sign-in method in every Microsoft Entra ID edition, including the free one that comes with every Microsoft 365 business plan. Making them mandatory through Conditional Access — for example, requiring passkeys for admins — needs Entra ID P1, which is included in Microsoft 365 Business Premium.
Are passkeys enough security on their own?
They protect the login, which is the most-attacked point — but not the endpoint, the data or the humans, who can still be talked into paying a fake invoice. That gap is what phishing simulation training is for. Passkeys belong inside a layered programme like our managed cybersecurity service, not instead of one.
Make the move
Key IT runs passkey rollouts for Melbourne businesses as part of our Microsoft 365 management — policy, enrolment, recovery paths and the legacy cleanup that makes it stick. One project, and stolen passwords and relayed codes stop working on every account that makes the switch.
More insights
Microsoft's September tenant changes
Microsoft 365 September 2026 changes: 100GB Business mailboxes, Teams external chat limits…
Read article →Microsoft 365Microsoft's 2026 legacy login shutdown
Microsoft 365 legacy authentication is being retired: SMTP AUTH Basic Auth goes off by default in…
Read article →AICopilot's August 2026 update
Microsoft Copilot's August 2026 update adds Claude model choice, Cowork workflows and Notebooks for…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.