Passkeys for business: should you ditch passwords?
Passwords are the weak point in most accounts. People reuse them, forget them, and hand them over to convincing fake login pages. Passkeys are designed to fix that. Here is what they are and how a business can approach them.
What is a passkey?
A passkey is a way to sign in without typing a password. When you create one, your device makes a pair of cryptographic keys. The public key is stored with the service. The private key stays on your device (or in a secure password manager you control).
To sign in, you prove it is you by unlocking the device, with a fingerprint, face scan or PIN. The device then proves to the service that it holds the private key. Nothing secret is sent across the internet, so there is nothing for an attacker to steal from a fake website or reuse elsewhere.
Passkeys are built on open standards (FIDO2 and WebAuthn) and are supported across the major platforms and browsers.
Why they are better than passwords
- Phishing-resistant. A passkey is tied to the real website. If someone sends you to a fake one, your device will not offer the passkey. That removes the biggest risk with passwords and text-message codes, where a person can be tricked into typing the secret.
- No reuse. Every passkey is unique to one service.
- Quicker to use. For most people, unlocking a phone is faster than typing a long password and finding a code.
- Less to reset. Fewer forgotten-password calls to the helpdesk.
Where do they fit?
Passkeys are not a switch you flip once. Think in layers:
- Multi-factor authentication (MFA) everywhere first. If you have not turned on MFA for Microsoft 365, email and remote access, do that before anything else. Cyber Essentials expects it on cloud services.
- Use stronger MFA methods. Authenticator app prompts are better than text messages. Passkeys and security keys are better still.
- Add passkeys for your most sensitive accounts. Admins, finance and executives are the sensible first group.
- Widen out as you learn what works.
Microsoft Entra ID, which sits behind Microsoft 365, supports passkeys, including through the Microsoft Authenticator app and FIDO2 security keys. Availability and policy settings depend on your set-up, so check with whoever manages your tenant. confirm current Microsoft Entra passkey availability and Unite’s rollout approach before publishing
The NCSC has published guidance on passkeys and password alternatives, and it is worth reading alongside this article.
Things to plan for
Lost or replaced devices. Decide how people recover access when a phone is lost. Synced passkeys (stored in a platform account such as Apple, Google or a password manager) make this easier, but then the security of that account matters a lot. Device-bound passkeys and hardware keys are more tightly controlled but need a spare.
Shared accounts. Passkeys are personal. If several people share one login, fix that first.
Older systems. Not every business app supports passkeys yet. You will keep some passwords for a while, so use a password manager and unique, long passwords for those.
Staff training. The first time someone is asked to “create a passkey” it looks unfamiliar. A short how-to avoids confusion. Our FAQ page already covers setting up Microsoft Authenticator, which is a good start.
Does a passkey replace MFA?
A passkey is itself a strong form of multi-factor authentication: it combines something you have (the device) with something you are or know (the biometric or PIN). So you do not usually need to add a second code on top. Follow your provider’s guidance for how the two interact.
Our advice
Do not wait for a perfect, password-free future. Turn on MFA everywhere, move to phishing-resistant methods for high-risk accounts, and then expand. It will make phishing attacks much less effective, though people still need to know what to look for. Our guide to spotting and stopping phishing covers that.
For how identity protection fits with the rest of your defences, see our cyber security hub. If you would like help planning a rollout across your Microsoft 365 users, talk to us about managed IT.
