This guide explains passkeys in Microsoft 365, how they work and how to enable them.
Passwords are the weakest link in most businesses. They are reused, guessed, stolen and phished. Passkeys offer a better way: a fast, secure sign-in that does not rely on a password at all. Here is how passkeys work and how to start using them in Microsoft 365.
What are passkeys?
A passkey is a digital credential stored on a device you already own, such as your phone, laptop or a security key. Instead of typing a password, you approve the sign-in with your fingerprint, face or device PIN. The passkey is based on the FIDO2 standard, which is supported by Microsoft, Apple, Google and many other providers.
How do passkeys work?
When you create a passkey, your device generates a pair of cryptographic keys. The private key stays on your device and never leaves it. The public key is stored with the service, in this case Microsoft Entra ID. When you sign in, the service sends a challenge, your device signs it after you confirm with a biometric or PIN, and the service verifies the result with the public key. No shared secret is ever sent, so there is nothing for an attacker to steal or phish.
Why use passkeys in Microsoft 365?
- Phishing resistance. A passkey only works on the genuine Microsoft sign-in, so fake pages cannot capture it.
- Better security than passwords. There is no password to guess, reuse or leak in a breach.
- Faster sign-in. A touch or glance is quicker than typing a long password and a code.
- Fewer help desk calls. Fewer forgotten passwords and lockouts.
- Strong MFA in one step. A passkey combines something you have with something you are or know.
Enabling passkeys in Microsoft 365
- Turn on the method. In the Microsoft Entra admin centre, enable the passkey (FIDO2) method in your authentication methods policy and choose which users or groups can use it.
- Decide which passkey types you allow. You can allow passkeys in Microsoft Authenticator, on security keys, or both, and restrict by model if needed.
- Register users. Users add a passkey from their security info page. New users can use a Temporary Access Pass to register one securely on day one.
- Require it where it matters. Use Conditional Access authentication strengths to require phishing-resistant sign-in for administrators and sensitive apps.
- Plan for recovery. Encourage a second passkey or security key as a backup, and keep a clear process for lost devices.
Things to consider
Not every older app and device supports passkeys yet, so plan a staged rollout and keep a fallback method during the transition. Start with administrators and high-risk staff, then expand.
Final thoughts
Key takeaways
- A passkey is a digital credential on a device you already own, approved with a fingerprint, face or device PIN, and based on the FIDO2 standard.
- The private key never leaves the device, so there is no shared secret to steal or phish.
- New users can use a Temporary Access Pass to register a passkey securely on day one.
Passkeys in Microsoft 365: frequently asked questions
What are passkeys?
A passkey is a digital credential stored on a device you already own, such as your phone, laptop or a security key. Instead of typing a password, you approve the sign-in with your fingerprint, face or device PIN. Passkeys are based on the FIDO2 standard, which is supported by Microsoft, Apple, Google and many other providers.
Why use passkeys in Microsoft 365?
They resist phishing because a passkey only works on the genuine Microsoft sign-in, remove the password that can be guessed, reused or leaked, make sign-in faster, reduce forgotten-password calls and combine strong MFA into one step.
How do I enable passkeys?
In the Microsoft Entra admin centre, enable the passkey (FIDO2) method in your authentication methods policy and choose who can use it, decide which passkey types you allow, register users from their security info page, and use Conditional Access authentication strengths to require phishing-resistant sign-in for administrators and sensitive apps.
Related reading: Microsoft Entra ID consulting. For more detail, see Microsoft guidance on passkeys and FIDO2.
Passkeys are one of the biggest security improvements available to Microsoft 365 users, and they make life easier too. Total Solutions IT can help you plan and roll them out safely. Call 02 6061 4222 to get started.
