Passwords get stolen. Approval prompts get fatigued into submission. Passkeys are the first login technology that makes the standard phishing playbook simply not work — and Microsoft 365 supports them today.
One of the most common ways into a business is still a login: a password that was phished, guessed, reused from another breached site, or bought on the dark web. Multi-factor authentication raised the bar, but attackers adapted — flawless AI-written phishing emails that lead to fake login pages relaying codes in real time, and "MFA fatigue" attacks that bombard staff with approval prompts until someone taps yes. Passkeys close both doors.
What is a passkey, in plain English?
A passkey is a passwordless, phishing-resistant way to sign in: a cryptographic key pair that lives on your device — your phone, laptop or a hardware security key — and unlocks with your fingerprint, face or PIN. When you sign in, the device proves it holds the key for that exact website. There is no password to steal, nothing to type into a fake page, and no code to relay.
The security property that matters: a passkey only works with the genuine site it was created for. A convincing fake login page achieves nothing, because the passkey will not respond to it. That is what "phishing-resistant" actually means. Our plain-English cyber security glossary defines the related terms, from AiTM phishing to MFA fatigue.
Why are passkeys better than the MFA you already have?
Passkeys beat conventional MFA because they remove the human judgement step that attackers exploit. Nobody has to spot the fake page or resist the fifth approval prompt at 11pm — the technology refuses on their behalf. They are also faster: a fingerprint beats typing a password plus a six-digit code, so this is a rare security upgrade staff actively like.
How do you roll out passkeys in Microsoft 365?
You roll out passkeys in Microsoft 365 through Entra ID's authentication methods, and the sensible path looks like this:
Enable passkeys in Entra ID
Microsoft Authenticator can hold passkeys on staff phones, and hardware keys (like YubiKeys) suit shared or high-risk roles.
Pilot with a friendly group
A handful of staff register passkeys and live on them for a fortnight.
Register the whole team
A short, guided enrolment; most people are done in minutes.
Tighten policy over time
Require phishing-resistant methods for admins first, then step down weaker factors for everyone as coverage grows.
Two details matter: keep a recovery path for lost devices (a second registered passkey or a temporary access pass), and make sure legacy authentication is fully off — there is no point fitting a vault door while a side window stays open.
One attack passkeys don't stop on their own is device code phishing, where a lure gets someone to type an attacker's short code into Microsoft's genuine sign-in page. The page is real, so the passkey approves the sign-in as normal and the attacker's device is let in. A Conditional Access policy that blocks the device code flow for every account that doesn't need it closes that gap (it needs Entra ID P1, which Business Premium includes), so add it to the same rollout.
Frequently asked questions
What happens if someone loses their phone?
Their passkey is protected by the phone's own biometrics or PIN, so the finder cannot use it. The person signs in via their backup method, the old passkey is revoked, and a new one is registered on the replacement device — a quick helpdesk job, not a crisis.
Do passkeys work for Macs, iPhones and Android together?
Yes. Passkeys are an industry standard (FIDO2/WebAuthn) supported across Apple, Google and Microsoft ecosystems, and they sync within each platform's credential manager.
What does passwordless login mean for a business?
Passwordless login means staff sign in with a device they hold plus a fingerprint, face or PIN, instead of typing a password that can be phished or reused. In Microsoft 365 that typically means a passkey in Microsoft Authenticator, Windows Hello on a work laptop, or a hardware security key for shared and high-risk roles.
Do we have to get rid of passwords entirely?
Not on day one. Most businesses run passkeys alongside existing MFA, then progressively require the stronger method — admins first, everyone eventually. The end state is passwordless; the path there is gradual.
Does a passkey count as phishing-resistant MFA?
Yes. A passkey is multi-factor in a single step — the device holding the key plus your fingerprint, face or PIN — and because it only answers the genuine site, it cannot be phished or relayed. That matters for compliance too: the Essential Eight expects phishing-resistant MFA from Maturity Level Two.
Do we need a special Microsoft 365 licence for passkeys?
No. Passkeys are a sign-in method in every Microsoft Entra ID edition, including the free one that comes with every Microsoft 365 business plan. Making them mandatory through Conditional Access — for example, requiring passkeys for admins — needs Entra ID P1, which is included in Microsoft 365 Business Premium.
What if an account was phished before we switched to passkeys?
Clean it up first, then register the passkey. Phishing kits that relay the real Microsoft sign-in keep the session as well as the password, and an attacker may add their own authenticator to get back in after a reset, so adding a passkey to an account that is still compromised doesn't lock them out. Block sign-in, reset the password, sign out every session, and remove any MFA methods, app consents and inbox rules you don't recognise. Our first-hour checklist for a hacked Microsoft 365 account walks through each step; enrol the passkey once the account is clean.
Are passkeys enough security on their own?
They protect the login, which is the most-attacked point — but not the endpoint, the data or the humans, who can still be talked into paying a fake invoice. That gap is what phishing simulation training is for. Passkeys belong inside a layered programme like our managed cybersecurity service, not instead of one.
Make the move
Key IT runs passkey rollouts for Melbourne businesses as part of our Microsoft 365 management — policy, enrolment, recovery paths and the legacy cleanup that makes it stick. One project, and stolen passwords and relayed codes stop working on every account that makes the switch.
Are your staff's logins already exposed? A free dark web scan checks your business email domain against known breaches.
Request the Free Scan