What Are Passkeys — and Should Your Business Start Using Them?

Passwords have been a weak point in business security for a long time. 

Employees forget them. 

They reuse them. 

They write them down. 

They enter them into fake websites. 

Attackers steal them through phishing, malware, credential breaches, and social engineering. 

Multi-Factor Authentication has helped significantly, but attackers have adapted to that too. 

That is why the technology industry is moving toward something different: 

Passkeys. 

Passkeys are designed to replace traditional passwords with a cryptographic sign-in method that is much harder to steal through phishing. 

Instead of typing a password and then entering a code, an employee may simply use: 

• Face recognition  

• A fingerprint  

• A device PIN  

• A physical security key  

Behind the scenes, the authentication process works very differently from a password. 

For many businesses, passkeys may eventually become a normal part of how employees sign into Microsoft 365 and other important applications. 

The question is not necessarily whether passwords will disappear tomorrow. 

The better question is: 

Should your business start preparing for passwordless authentication now? 

What Is a Passkey? 

A passkey is a digital credential used to sign into a website or application without entering a traditional password. 

When a passkey is created, two cryptographic keys are involved: 

• A private key  

• A public key  

The private key stays protected on the user's device or approved credential provider. 

The public key is registered with the website or application. 

When the employee signs in, the application sends a challenge. 

The employee confirms their identity locally using something such as a fingerprint, face recognition, or PIN. 

The device then proves that it possesses the correct private key. 

The private key itself does not need to be sent across the internet. 

Microsoft describes passkeys as phishing-resistant credentials built around public-key cryptography rather than shared secrets like passwords. 

Why Is That Better Than a Password? 

A password is a secret the employee knows. 

Unfortunately, that means the employee can also accidentally give it to someone. 

If a phishing page says: 

“Enter your Microsoft password,” 

the employee can type it in. 

The attacker now has the password. 

A passkey behaves differently. 

The credential is associated with the legitimate website or application where it was created. 

If an employee lands on a fake website pretending to be Microsoft, the passkey is not simply handed over to that site. 

Microsoft specifically identifies this origin-bound behavior as one of the reasons passkeys resist phishing. 

Passkeys Remove One of Phishing's Biggest Advantages 

Traditional phishing depends heavily on impersonation. 

An attacker creates a page that looks like: 

• Microsoft  

• Google  

• A bank  

• DocuSign  

• Dropbox  

• A payroll provider  

The employee sees the familiar logo and enters credentials. 

The attacker does not need to break encryption. 

They just need to fool the person. 

Passkeys change that dynamic. 

A convincing logo is not enough. 

The authentication credential is tied to the legitimate site. 

That makes many remote credential-phishing attacks significantly harder.  

Are Passkeys the Same Thing as MFA? 

Not exactly, but a passkey can satisfy MFA requirements. 

Microsoft considers passkeys a form of multi-factor authentication when the user has the device containing the credential and must unlock it with a PIN or biometric.  

For example: 

Something you have: 
The device holding the passkey. 

Something you know or are: 
The device PIN, fingerprint, or facial recognition used to unlock it. 

The experience can actually feel simpler than traditional MFA because the employee may not need to: 

1. Enter a password.  

1. Wait for a code.  

1. Enter the code.  

1. Approve another prompt.  

The stronger security can come with fewer steps. 

What Is FIDO2? 

You will probably hear FIDO2 mentioned whenever passkeys are discussed. 

FIDO stands for Fast Identity Online. 

FIDO2 is a set of open authentication standards that enable passwordless and phishing-resistant authentication. 

Microsoft Entra ID supports passkeys based on FIDO2 standards.  

You do not need every employee to understand the technical details. 

For a business owner, the important takeaway is: 

FIDO2 allows authentication to work without sending a reusable password that an attacker can steal. 

What Does Signing In With a Passkey Look Like? 

For the employee, the experience may be very simple. 

They open Microsoft 365. 

Instead of typing a password, they may be asked to use a passkey. 

They confirm their identity with: 

• Face recognition  

• Fingerprint  

• PIN  

• Security key  

And they are signed in. 

The complicated cryptographic process happens in the background. 

That is an important advantage. 

Strong security controls are much easier to deploy when employees do not hate using them.

What Types of Passkeys Can Businesses Use? 

There are several approaches. 

Device-Bound Passkeys 

A device-bound passkey remains on a specific device. 

Examples may include: 

• A FIDO2 hardware security key  

• A passkey stored in Microsoft Authenticator  

• A passkey stored locally in Windows  

Because the private credential remains tied to that device, this can provide very strong protection. 

Microsoft recommends FIDO2 security keys particularly for elevated users and environments requiring stronger security controls.  

Synced Passkeys 

Synced passkeys can be stored through an approved credential manager and made available across trusted devices. 

This can improve convenience because employees are not necessarily tied to one physical device. 

Microsoft Entra supports both device-bound and synced passkey models, though businesses should consider the security and management needs of their environment before selecting an approach.  

What Is a FIDO2 Security Key? 

A security key is a small physical authentication device. 

It may connect using: 

• USB  

• NFC  

• Bluetooth  

The employee possesses the physical key and uses it during authentication. 

These can be particularly useful for: 

• IT administrators  

• Microsoft 365 administrators  

• Executives  

• Accounting employees  

• Payroll employees  

• Employees with access to highly sensitive systems  

Microsoft notes that FIDO2 security keys are device-bound passkeys and recommends them for highly regulated environments or users with elevated privileges. 

What Happens if Someone Steals the Security Key? 

A security key should not normally work simply because someone possesses it. 

The authentication process can also require local verification such as a PIN. 

That means finding or stealing the physical device does not necessarily provide immediate access to the account. 

This is similar to an ATM card. 

Having the card alone should not be enough. 

You still need the correct verification.

What Happens if an Employee Loses Their Phone or Computer? 

This is one of the most important questions businesses should address before rolling out passkeys. 

Security cannot stop at login. 

You need a recovery process. 

That may include: 

• Another registered passkey  

• A backup security key  

• A Temporary Access Pass  

• Administrator-assisted recovery  

• A properly configured account-recovery process  

The recovery method should be secure enough that an attacker cannot simply bypass the strong authentication by claiming: 

“I lost my phone.” 

This is where planning matters.

Account Recovery Cannot Be Weaker Than the Authentication 

Imagine locking your front door with an extremely strong lock but leaving the spare key under the welcome mat. 

The strong lock does not help much. 

The same concept applies to authentication. 

A business may deploy passkeys but then use a weak identity-verification process when someone loses a device. 

An attacker could simply call the help desk and say: 

“I lost my phone. Please reset everything.” 

Help desk and IT staff need strong identity-verification procedures before resetting authentication methods. 

Should Everyone Get Passkeys at Once? 

Probably not. 

For most small businesses, a phased rollout makes more sense. 

Start with the accounts that would cause the most damage if compromised. 

That commonly includes: 

• Microsoft 365 Global Administrators  

• IT administrators  

• Business owners  

• Executives  

• Accounting  

• Payroll  

• HR  

• Employees authorized to move money  

• Employees with sensitive customer information  

These users are also attractive phishing targets.

Start With Microsoft 365 Administrators 

Administrator accounts should be near the top of the list. 

If an attacker compromises an ordinary employee account, that is serious. 

If an attacker compromises a Global Administrator, the consequences may be dramatically worse. 

Administrators may be able to: 

• Create accounts  

• Reset passwords  

• Change authentication  

• Access cloud resources  

• Modify security settings  

• Grant permissions  

• Change email configurations  

Strong phishing-resistant authentication is particularly valuable for privileged accounts. 

Accounting and Payroll Should Be High Priority Too 

Finance employees are frequent targets because they can move money. 

Attackers may attempt to compromise them through: 

• Fake invoices  

• Vendor impersonation  

• Executive impersonation  

• Microsoft phishing  

• Payroll-change requests  

• Business Email Compromise  

Passkeys cannot eliminate every fraud scenario. 

But making account takeover harder removes one major pathway attackers use to monitor or impersonate finance employees. 

Do Passkeys Stop Business Email Compromise? 

They can reduce one important type of BEC risk: mailbox compromise caused by stolen login credentials. 

But Business Email Compromise can happen in other ways. 

For example: 

• An attacker compromises a vendor instead.  

• Someone registers a lookalike domain.  

• An employee responds to an impersonation email without any account being hacked.  

• A criminal socially engineers someone into changing payment instructions.  

That means passkeys should be combined with: 

• Email security  

• Employee training  

• Payment verification procedures  

• Microsoft 365 monitoring  

• Domain protection  

• Conditional Access  

Cybersecurity works best in layers. 

Do Passkeys Replace Cybersecurity Training? 

No. 

Passkeys make credential phishing harder. 

They do not prevent every form of social engineering. 

An attacker may still convince an employee to: 

• Send money  

• Share sensitive data  

• Download malware  

• Change a bank account  

• Grant access  

• Reveal confidential information  

Employee awareness remains important even in a passwordless environment. 

What About Older Applications That Still Require Passwords? 

This is one of the practical challenges. 

A business may use: 

• Microsoft 365  

• Accounting software  

• Legacy applications  

• VPN systems  

• Vendor portals  

• Industry-specific applications  

Not all of them will support passkeys. 

That means most businesses will operate in a mixed environment for some time. 

Some systems may use passkeys. 

Others may still require passwords and traditional MFA. 

That is normal. 

Passwordless authentication should be viewed as a transition rather than an overnight replacement for everything. 

Microsoft Is Moving Toward Passkeys 

This is one reason businesses should start paying attention now. 

Microsoft Entra ID now positions passkeys as its default phishing-resistant credential and supports both synced and device-bound models.  

Microsoft has also announced a significant change to SMS and voice authentication. 

Beginning September 1, 2026, certain Entra users enabled for SMS or voice authentication will automatically be brought into passkey registration campaigns. 

Beginning February 1, 2027, Microsoft-provided SMS and voice authentication in Entra ID are scheduled to be retired, with organizations needing to move users to passkeys or another supported approach unless they configure an eligible customer-managed telecom provider.  

That makes this more than a theoretical future technology. 

Businesses using Microsoft 365 should start reviewing their authentication strategy now.

Why Microsoft Is Moving Away From SMS Authentication 

SMS MFA is still much better than a password alone. 

But it has weaknesses. 

Attackers may attempt: 

• SIM swapping  

• Social engineering  

• Real-time phishing  

• Code interception  

• Credential relay  

Passkeys do not rely on sending a reusable password or one-time SMS code to the user. 

That makes them resistant to several common credential-theft techniques.  

Passkeys Can Also Make Sign-In Easier 

Security improvements often create complaints from employees. 

More passwords. 

More codes. 

More prompts. 

More frustration. 

Passkeys can potentially do the opposite. 

Instead of: 

Password → code → approval 

the employee may simply: 

Look at the computer → authenticate → work. 

Microsoft reports that passkeys can improve sign-in success while reducing exposure to credential-based attacks.  

That combination is appealing: 

Better security with less friction. 

Passkeys Do Not Mean Businesses Can Forget About Device Security 

The device becomes an important part of authentication. 

That means businesses still need: 

• Device encryption  

• Screen locks  

• Endpoint protection  

• Patch management  

• Device management  

• Strong PIN policies  

• Lost-device procedures  

• Employee offboarding  

Strong identity protection and strong endpoint security should work together. 

Employee Offboarding Becomes Even More Important 

When an employee leaves, the company should know: 

• Which passkeys they registered  

• Which devices they used  

• Which security keys were issued  

• Which accounts they can still access  

• Which personal devices may contain company credentials  

Offboarding procedures should remove or revoke authentication methods along with normal account access. 

Questions to Ask Before Deploying Passkeys 

Before rolling them out, businesses should consider: 

• Which applications support passkeys?  

• Which employees should receive them first?  

• Should we use device-bound or synced passkeys?  

• Do administrators need physical security keys?  

• How will lost devices be handled?  

• How will users register new passkeys?  

• How will identity be verified during recovery?  

• What happens when an employee leaves?  

• Are personal devices allowed?  

• Does our help desk understand the recovery process?  

• Do our Conditional Access policies support the rollout?  

• Which legacy applications still require passwords?  

These questions help avoid creating security or support problems later.

A Practical Passkey Rollout for a Small Business 

For many small businesses, a sensible approach could look like this: 

Step 1: Review Current Authentication 

Identify who is currently using: 

• SMS  

• Voice calls  

• Authenticator prompts  

• One-time codes  

• Security keys  

• Windows Hello  

Step 2: Identify High-Risk Accounts 

Prioritize administrators, executives, accounting, payroll, and other sensitive roles. 

Step 3: Select the Passkey Approach 

Determine whether employees will use: 

• Microsoft Authenticator  

• Windows-based passkeys  

• Synced passkeys  

• FIDO2 security keys  

Step 4: Build the Recovery Process 

Decide how lost devices and authentication problems will be handled. 

Step 5: Pilot With a Small Group 

Start with a manageable group instead of moving everyone at once. 

Step 6: Train Employees 

Explain what is changing and why. 

Step 7: Expand Gradually 

Once the process is working reliably, expand to additional users. 

How Network Computer Pros Helps Businesses Strengthen Authentication 

Network Computer Pros helps small and mid-sized businesses review Microsoft 365 identity security and develop an authentication strategy appropriate for their environment. 

That can include reviewing: 

• Microsoft Entra ID  

• Multi-Factor Authentication  

• Passkeys  

• FIDO2 security keys  

• Microsoft Authenticator  

• Windows Hello  

• Conditional Access  

• Administrator accounts  

• Authentication methods  

• Account recovery  

• Employee onboarding and offboarding  

• Connected applications  

For most businesses, the goal is not: 

“Get rid of every password tomorrow.” 

The goal is to steadily reduce dependence on authentication methods that attackers can easily steal or phish. 

We support businesses throughout South Florida and Middle Tennessee, including Davie, Fort Lauderdale, Miami, Boca Raton, Nashville, Franklin, Brentwood, and surrounding communities.

Frequently Asked Questions About Passkeys for Business

Passwords Are Not Going to Disappear Overnight — But the Transition Has Started 

For decades, cybersecurity has tried to make passwords safer. 

Make them longer. 

Make them more complicated. 

Change them. 

Add MFA. 

Train employees not to give them away. 

Passkeys approach the problem differently. 

Instead of trying to make a shared secret impossible to steal, they remove much of the shared-secret problem altogether. 

That makes passkeys one of the most important changes happening in business authentication. 

Your company does not necessarily need to eliminate passwords tomorrow. 

But it should probably start asking: 

Which of our most important accounts could be protected with phishing-resistant authentication today? 

Network Computer Pros can help review your Microsoft 365 authentication methods, administrator accounts, MFA configuration, and readiness for passkeys. 

Schedule a quick cybersecurity consultation to review your business authentication strategy.