Passkeys for Business: What They Are and How to Roll Them Out

Most account break-ins at small businesses still start the same way: someone types their password into a convincing fake sign-in page. Multi-factor authentication helps, but codes sent by text or typed from an app can be phished too. Passkeys fix that problem at the root, and the major platforms now support them well enough for everyday business use.

Here is what passkeys are, what to decide before you turn them on, and how to roll them out without flooding your help desk.

What a passkey is, in plain English

A passkey is a sign-in credential that replaces a password. Instead of a secret you type, your device holds a cryptographic key and proves it has that key whenever you sign in. You unlock it the same way you unlock your phone or laptop: fingerprint, face or PIN.

According to the FIDO Alliance, which maintains the standard, each passkey is tied to one specific website or app. That detail is what makes passkeys phishing-resistant: a fake look-alike site simply cannot ask for the real site's passkey, so there is nothing for the user to hand over by mistake. There is also no password database on the server for attackers to steal.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has been blunt about this. Its fact sheet on phishing-resistant MFA states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication", which is the technology passkeys are built on.

Synced vs. device-bound passkeys

This is the main decision you will make, and it is worth understanding before you start.

	Synced passkeys	Device-bound passkeys
Where the key lives	In a passkey provider (for example Apple Passwords / iCloud Keychain, Google Password Manager, or a password manager) and syncs across the user's devices	On one physical device only: a hardware security key, or an authenticator app such as Microsoft Authenticator
If a phone is lost	Passkey is still available on the user's other devices	User needs a backup method or a second key
Convenience	Very high	Good, but users must keep the device with them
Control for the business	Lower: the key is backed up in a personal or third-party cloud account	Higher: you can require specific approved models
Typical use	Most staff	Admins, executives, finance, shared or high-risk accounts

Both kinds are phishing-resistant. Microsoft's guidance is to treat synced passkeys as phishing-resistant credentials but with the security posture of other unattested authenticators, which is why many businesses reserve device-bound passkeys or hardware keys for administrator accounts. NIST's updated digital identity guidelines also cover syncable authenticators and the conditions under which they can be used.

Where passkeys work for a typical small business

• Microsoft 365 / Microsoft Entra ID: passkeys are available in all Entra ID editions, including the free one, with no extra license, according to Microsoft's documentation. Entra supports synced passkeys and device-bound passkeys on FIDO2 security keys and in Microsoft Authenticator.
• Google Workspace: admins can allow users to skip passwords at sign-in by using passkeys.
• Operating systems and browsers: current versions of Windows, macOS, iOS, Android and the major browsers support passkeys.
• Other business apps: support varies. If an app signs in through Microsoft or Google (single sign-on), it benefits automatically.

A step-by-step rollout plan

1. Take stock

• List the systems people sign in to, and which ones use Microsoft or Google sign-in.
• Check that computers and phones are on supported operating system versions.
• Identify high-risk accounts: global admins, finance, payroll, executives, shared mailboxes.

2. Decide your policy

• Will regular staff use synced passkeys, device-bound passkeys in an authenticator app, or both?
• Will admins be required to use hardware security keys? Plan for two keys per admin, one kept somewhere safe.
• What is the backup sign-in method if someone loses their device, and who can verify identity before resetting it?

3. Turn passkeys on (Microsoft 365 example)

In the Microsoft Entra admin center, an Authentication Policy Administrator goes to Entra ID > Security > Authentication methods > Policies > Passkey (FIDO2). From there you can opt in to passkey profiles, which let you set different rules for different groups: for example, device-bound passkeys with attestation for IT admins, and device-bound or synced passkeys for everyone else. Make sure Allow self-service set up is on so people can register their own passkeys. Microsoft's how-to guide has the current screens.

Note two practical details from Microsoft's documentation: users must have completed multi-factor sign-in within the past five minutes before they can register a passkey, and passkey registration is not supported for guest accounts.

4. Pilot with a small group

Start with five to ten people, including at least one less technical user. Have them register a passkey at Security info (or in their Google account), use it for two weeks, and note anything confusing. Write a one-page guide with screenshots from your own setup.

5. Roll out in waves

• Admins and finance first, since they are the most valuable targets.
• Then department by department, with a short live walkthrough for each group.
• Keep the old method available during the transition so nobody is locked out.

6. Require it where it matters

Once people are enrolled, use Conditional Access in Microsoft Entra with a phishing-resistant authentication strength to require passkeys for admin roles and sensitive apps. Then gradually tighten the rules for everyone else.

7. Clean up

• Remove weaker methods such as text-message codes where you no longer need them.
• Add passkey registration to your new-hire checklist and passkey removal to your offboarding checklist.
• Review who has which methods registered every few months.

Common questions from staff

"Is my fingerprint sent to Microsoft or Google?"

No. The fingerprint or face scan only unlocks the passkey on your own device. The website never receives it.

"What if I lose my phone?"

With synced passkeys, the passkey is still on your other devices. With device-bound passkeys, you use your backup method or contact IT, who will verify it is really you before issuing a new one.

"Do I still need a password?"

Often yes, for now. Many organizations keep a password on the account during the transition. The goal is that you stop typing it day to day, and that it eventually stops being enough on its own to sign in.

Rollout checklist

• Inventory sign-ins and high-risk accounts
• Choose synced, device-bound or a mix, per group
• Buy two hardware keys per administrator if you are using them
• Define backup sign-in and identity-check process for resets
• Enable passkeys and self-service registration
• Pilot, write a short guide, then roll out in waves
• Enforce phishing-resistant sign-in for admins and sensitive apps
• Update onboarding and offboarding checklists

Getting help with your rollout

Passkeys are one of the most effective security upgrades a small business can make, and most of the work is planning and communication rather than technology. If you would like help setting them up across Microsoft 365, Right On Tech can plan and run the rollout as part of our managed IT service, or simply get in touch with questions.