Passkeys for Small Business: What You Actually Need to Know

For years, "the year of passwordless" was an industry running joke — always coming, never arriving. In 2026 it quietly arrived. Passkeys are now in active use at enormous scale, consumer awareness has crossed the point where most people have used one somewhere, and — the part that matters for businesses — the major platforms have turned the infrastructure on by default.

Most usefully for a small business: if you use any edition of Microsoft 365, Microsoft began automatically enabling passkey capability across Entra ID tenants during 2026, which means the infrastructure is already in your account waiting to be switched on. You don't have to buy or build anything to start. So it's worth understanding what this actually is, rather than letting it drift past as more security noise.

What a passkey actually is

A passkey is a login credential that replaces a password with a pair of cryptographic keys. When you create a passkey for an account, your device generates two linked keys: a private key that never leaves your device, and a public key that's stored with the service you're logging into. Logging in proves you hold the private key — usually via your device's fingerprint, face, or PIN — without ever transmitting a secret that could be stolen.

The practical consequences are what make it worth caring about:

• There's no password to phish. An attacker can build a pixel-perfect fake login page, and it doesn't matter — there's no password for you to type into it, and the private key won't authenticate against the wrong site because it's cryptographically bound to the real one.
• There's nothing to steal in a breach. The service only stores your public key, which is useless to an attacker on its own. There's no password database to leak.
• There's no code to intercept. Unlike SMS or app-based one-time codes, there's no shared secret in transit that a determined attacker can phish or redirect.

Why this beats "just turn on MFA"

Multi-factor authentication is still the single highest-value security step most businesses can take, and if you've got nothing else, turn it on today. But not all MFA is equal, and passkeys close a gap that ordinary MFA leaves open.

The weakness in common MFA — SMS codes, or approve-this-login prompts — is that it's phishable. A capable attacker runs a fake login page that relays your details to the real site in real time, catches the one-time code as you enter it, and is in. Prompt-bombing (spamming approval requests until someone taps "yes" out of fatigue) exploits the same human-in-the-loop weakness.

The honest caveats

This isn't magic, and a straight assessment means naming the friction:

• Account recovery is the hard part. If a passkey lives on a device and that device is lost, you need a recovery path — a backup passkey on another device, or a fallback method. Getting recovery right matters more than the rollout itself, because a locked-out employee with no recovery route is its own kind of outage.
• Most businesses will run passwords in parallel for a while. Not every application supports passkeys yet, so realistically you're enabling passkeys alongside passwords, not doing a hard cutover. That's fine — it's how the transition is meant to work — but it means you don't get the full benefit until passwords are actually retired for a given system.
• Device and ecosystem sync has edges. Passkeys sync through platform ecosystems (Apple, Google, Microsoft), which is convenient but means thinking about how staff who use mixed devices will be covered.

How to roll them out sensibly

You don't need a project plan or a consultant for a small team. A sane, low-risk sequence looks like this:

• Start with a pilot group, typically whoever's most comfortable with tech, before enabling it for everyone. This surfaces any app-specific quirks while they only affect a couple of people.
• Enable passkeys as an option, not a mandate, first. Let people enrol a passkey while passwords still work, so nobody's locked out during the transition.
• Prioritise the highest-risk accounts, especially anyone who handles payments, has admin access, or can see financial correspondence — the same accounts most targeted by the email-based fraud we cover in our Business Email Compromise guide.
• Sort out recovery before you need it. Make sure every user has a second passkey (on another device) or a documented fallback, so a lost phone isn't a lockout.
• Use built-in enrolment prompts if your platform offers them. Microsoft Entra, for example, can prompt users to register a passkey at next sign-in — far more effective than an all-staff email nobody reads.
• Retire passwords on a system only once passkey coverage is solid for it — that's when the phishing-resistance benefit becomes real rather than theoretical.

Frequently asked questions