In this guide · 8 sections
- 01What CSA's passwordless advisory says
- 02Passkeys in plain English
- 03How to turn on passkeys in Microsoft 365 (Entra ID)
- 04How to turn on passkeys in Google Workspace
- 05Lost phone and recovery: write the policy first
- 06Where passkeys still need MFA and other controls
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Passkeys are free to turn on in Microsoft Entra ID (all editions) and Google Workspace. Enable them in the admin console, have staff register one per device, keep a second sign-in method for recovery, and start with admin and finance accounts.
What CSA's passwordless advisory says
CSA's advisory Understanding Passwordless Authentication (AD-2026-011) was published on 26 August 2026 and last updated on 18 September 2026. It explains that passwords are stolen through phishing, credential stuffing with leaked passwords, password-stealing malware and guessing. It also warns that one-time codes do not fully fix this, because adversary-in-the-middle phishing pages can capture a password and the code together.
The useful part for a business owner is the table that sorts sign-in methods into phishing-resistant and not.
| Sign-in method | Phishing-resistant? | Why, per CSA |
|---|---|---|
| Passkeys (FIDO2/WebAuthn) | Yes | Bound to the real website; private key stays on the device |
| FIDO2 security keys | Yes | Key checks the website before signing in |
| Windows Hello for Business | Yes | Device-bound credential unlocked by PIN or face |
| Push approval in an app | No | Staff can be tricked into approving |
| Magic links by email | No | The link itself can be intercepted |
| SMS one-time passwords | No | Codes can be typed into fake sites; SIM swap risk |
CSA's conclusion: where supported, prioritise phishing-resistant methods. It also lists residual risks that passkeys do not solve, such as malware on a device abusing a signed-in session, stolen session cookies, and weak account recovery.
Passkeys in plain English
A passkey is a login credential made of two keys. The private key stays on the phone, laptop, password manager or security key. The website only holds the public key. When you sign in, your device unlocks the passkey with your fingerprint, face or PIN and proves who you are to that exact website. A fake login page on a lookalike domain gets nothing it can reuse.
The FIDO Alliance, which publishes the standard, describes two kinds. Synced passkeys are copied across your devices by Apple, Google, Microsoft or a password manager. Device-bound passkeys live on one device or a hardware key and never leave it. Device-bound is stricter; synced is easier to recover when a phone is lost.
Synced passkeys suit
- Most staff on their own phones and laptops
- Teams that already use a business password manager
- Businesses that want easy recovery after a lost phone
Device-bound passkeys suit
- Global admins and the owner's account
- Finance staff who approve payments
- Shared or high-risk devices where you want a hardware key
How to turn on passkeys in Microsoft 365 (Entra ID)
Microsoft's passkey set-up guide confirms that passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Entra ID Free, with no extra licence. Entra supports synced passkeys and device-bound passkeys on security keys and in the Microsoft Authenticator app.
Sign in as an Authentication Policy Administrator
Open the Microsoft Entra admin centre with an account that has at least that role. A Global Administrator also works.
Open the Passkey (FIDO2) policy
Go to Entra ID, Authentication methods, Policies and select Passkey (FIDO2). Microsoft now uses passkey profiles; opting in is one-way, so read the banner before clicking.
Allow self-service set-up
On the Configure tab, set Allow self-service set up to Yes. If it stays No, staff cannot register a passkey from their Security info page.
Choose passkey types per group
In the Default passkey profile, allow synced and device-bound passkeys for general staff. Add a second profile that allows device-bound only for admins if you want stricter control. Up to three profiles are supported.
Target a pilot group first
Enable the method for a small group such as the owner and one admin, then widen it to all users after a week.
Ask staff to register at Security info
Each user goes to My Sign-ins, Security info, Add sign-in method, Passkey. Microsoft requires an MFA sign-in within the last five minutes before a passkey can be added.
Once staff have passkeys, you can go further with a Conditional Access authentication strength policy that requires a phishing-resistant method for admin portals. That needs Entra ID P1, which is included in Microsoft 365 Business Premium. Our Microsoft 365 security checklist covers the rest of the tenant settings.
How to turn on passkeys in Google Workspace
Google Workspace users can already add passkeys as a 2-Step Verification method. To let them sign in with a passkey instead of a password, an admin switches on Skip passwords, which Google's admin help page says is off by default.
- In the Google Admin console, go to Security, Authentication, Passwordless. You need the Security Settings administrator privilege.
- Click Skip passwords and pick the organisational unit, or leave it at the top level for everyone.
- Tick Allow users to skip their password and authenticate with a passkey, then Save.
- Tell staff to add a passkey at g.co/passkeys and turn on Skip password when possible in their account.
- Optional for admins: under Passkeys restriction, allow passkeys on hardware security keys only for a stricter OU.
Two details trip people up. Turning on Skip passwords does not delete anyone's password, and adding a passkey does not switch on 2-Step Verification by itself. Keep 2SV enforced for everyone, as described in our MFA set-up guide, so the password route stays protected too.
Lost phone and recovery: write the policy first
CSA lists weak account recovery as one of the main ways passwordless protection gets undermined. If a scammer can phone your office, claim to be a staff member with a lost phone and get a reset, passkeys have not helped. Decide the process before the rollout.
Passkey recovery policy
Microsoft's Temporary Access Pass is a time-limited code that lets a user sign in once and register a new passkey. It is the cleanest way to handle a lost phone in Microsoft 365.
Where passkeys still need MFA and other controls
Passkeys protect the moment of sign-in. They do not protect a laptop that is already infected or a session cookie copied after sign-in, which CSA calls out directly. Pair them with automatic updates, endpoint protection and short session lifetimes for admin roles.
Many business apps outside Microsoft and Google do not support passkeys yet: accounting software, bank portals, supplier portals, domain registrars. For those, a business password manager is still the right tool, and most managers can now also store passkeys. Our password manager guide compares the options and their prices.
Do it yourself or get help?
A small team on Microsoft 365 or Google Workspace can switch passkeys on in an afternoon. The harder parts are deciding who gets device-bound keys, writing the recovery rules, and checking that no legacy sign-in path is left open.
Our Microsoft 365 / Google Security Lockdown (S$590) enables passkeys and MFA, sets up break-glass accounts, turns off legacy sign-ins and documents your recovery process. If staff still keep passwords in browsers or spreadsheets, the Password Manager Rollout (S$290) moves them to a business vault that also stores passkeys.
Frequently asked questions
No. Microsoft states that passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Entra ID Free, with no extra licence. Business Basic and Business Standard tenants can enable them. You only need Entra ID P1, included in Business Premium, if you want Conditional Access policies that require a passkey for certain apps or admin roles.
Yes, against phishing. CSA's advisory explains that one-time codes can be captured by adversary-in-the-middle phishing pages along with the password. A passkey is cryptographically bound to the real website, so a lookalike page cannot use it. Authenticator apps are still far better than SMS and remain a good backup method.
If the passkey was synced, it is usually still on their laptop or in their password manager. If it was device-bound, an admin removes it from the account and issues a recovery method, such as a Temporary Access Pass in Microsoft 365 or backup codes in Google Workspace. Verify the person by video call or in person before resetting anything.
No. CSA advisories are guidance, not law. The advisory recommends prioritising phishing-resistant methods where supported. CSA notes that stolen and reused passwords continue to contribute to account compromise, so following the advice closes a common attack route for a small team.
Yes, and that is common in small businesses. A synced passkey on a personal phone is protected by the phone's screen lock. Make sure staff phones have a PIN or biometric lock and current updates, and remove the work passkey from the account when someone leaves. For admins, consider a company-owned hardware key instead.