Passkeys stop phishing in a way passwords and text codes cannot. How passkeys work, where they are supported, and how to roll them out to a small business team.
October is Cybersecurity Awareness Month, and the biggest change in account security in years is finally practical for small businesses: passkeys. Passwords can be guessed, reused, leaked in breaches, and typed into fake login pages. Text message codes and simple push approvals help, but modern phishing kits can capture them in real time. Passkeys are designed so that they cannot be phished, reused, or stolen from a website breach, and they are now supported by Microsoft 365, Google Workspace, Apple, and most major business applications.
What Is a Passkey?
A passkey is a pair of cryptographic keys created for a specific website or app. The private key stays on your device or in your password manager, protected by your fingerprint, face, or device PIN. The public key is stored by the website. When you sign in, the site sends a challenge, your device signs it with the private key after you unlock it, and the site verifies the signature. You never type a secret, and there is nothing useful for a website breach to leak.
The crucial security property is that passkeys are bound to the real website address. If an employee clicks a phishing link to a fake Microsoft login page, the passkey simply will not work there, because the fake site has a different domain. That is why passkeys are called phishing-resistant, and why agencies like CISA recommend phishing-resistant MFA as the strongest option. It closes the gap that attackers use in business email compromise and account takeover attacks.
Synced Passkeys vs. Device-Bound Passkeys
Synced passkeys are stored in a password manager or platform keychain, such as iCloud Keychain, Google Password Manager, 1Password, or Bitwarden, and are available on all of a user's devices. They are convenient and easy to recover if a phone is lost. Device-bound passkeys live on a single device, such as a hardware security key like a YubiKey, or in the Microsoft Authenticator app, and never leave it. They offer the highest assurance and are well suited to administrators and finance staff.
For most small businesses, a practical approach is synced passkeys through a business password manager for everyday applications, and device-bound passkeys in Microsoft Authenticator or on hardware security keys for administrator accounts and anyone who approves payments. Our password manager guide covers choosing a business password manager that supports passkeys.
Where Passkeys Work Today
Microsoft 365 and Microsoft Entra ID support passkeys through Microsoft Authenticator, FIDO2 security keys, and Windows Hello for Business. Google Workspace supports passkeys for user sign-in. Apple, Google, and Microsoft personal accounts, along with many banking, payroll, accounting, and SaaS applications, now offer passkey sign-in. Coverage is not universal, so most businesses will run passkeys alongside traditional MFA for a while.
Rolling Out Passkeys to Your Team
Start with the accounts that matter most: Microsoft 365 or Google Workspace administrators, the business owner, and anyone in finance or HR. In Microsoft 365, enable passkeys in the authentication methods policy, have users register a passkey in Microsoft Authenticator or a security key, and then use conditional access authentication strengths to require phishing-resistant MFA for administrators. Our Microsoft 365 security guide covers conditional access in more detail.
Expand to all users in phases. Run a short training session explaining what passkeys are, why they are safer and faster, and what to do if they get a new phone. Most employees like passkeys once they try them, because signing in becomes a fingerprint or face scan instead of a password plus a code. Plan account recovery carefully: register at least two sign-in methods per user, keep a documented process for verifying identity before resetting access, and give administrators a backup hardware key stored securely.
Once passkeys are in place for an application, disable weaker methods where possible. Leaving SMS codes enabled as a fallback gives attackers a way around your strongest protection. Include passkey enrollment in your employee onboarding checklist so every new hire starts with phishing-resistant sign-in.
Frequently Asked Questions
What is a passkey?
A passkey is a passwordless sign-in method that uses a cryptographic key pair stored on your device or in a password manager, unlocked with your fingerprint, face, or device PIN. It cannot be phished, reused, or leaked in a website breach.
Are passkeys more secure than passwords with MFA?
Yes. Passkeys are bound to the real website, so they cannot be used on phishing sites, and there is no password or one-time code for attackers to steal. Text message and simple push MFA can be bypassed by modern phishing kits.
Does Microsoft 365 support passkeys?
Yes. Microsoft Entra ID, which secures Microsoft 365, supports passkeys in Microsoft Authenticator, FIDO2 security keys such as YubiKey, and Windows Hello for Business. Administrators enable them in the authentication methods policy.
What happens if I lose the phone with my passkeys?
Synced passkeys stored in iCloud Keychain, Google Password Manager, or a business password manager are restored when you sign in on a new device. For device-bound passkeys, users should register a second method, and businesses should have a documented identity verification process for recovery.
If you want to roll out passkeys and phishing-resistant MFA across Microsoft 365 or Google Workspace, HelpTek can plan and implement the change for Albuquerque and Santa Fe businesses, including security keys for administrators and staff training. Learn about our cybersecurity services or contact us to get started this Cybersecurity Awareness Month.
