In this guide · 8 sections
- 01Why security keys stop phishing that other MFA doesn't
- 02Who in a small business needs a security key
- 03Two keys per person, and what they cost
- 04Enrolling keys in Microsoft 365 (Microsoft Entra ID)
- 05Enrolling keys in Google Workspace
- 06When a key is lost: a simple process
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Give security keys first to admins, directors and finance staff, the accounts attackers target for payments and takeover. Issue two keys per person (one kept safe as a backup), enrol both in Microsoft 365 or Google Workspace, and write a lost-key process. FIDO2 keys start from about S$40 in Singapore.
Why security keys stop phishing that other MFA doesn't
Most multi-factor authentication asks you to type a code or approve a prompt. A phishing kit that sits between you and the real site can pass those along in real time. A security key works differently: it uses the FIDO2 standard, the same one behind passkeys, and only answers a sign-in request from the genuine website it was registered with. A look-alike domain gets nothing.
The FIDO Alliance's passkey page explains the standard. Our guide to phishing-resistant MFA compares security keys with passkeys on phones and laptops, which offer the same protection, and our guide to the CSA passwordless advisory covers the Singapore context.
Who in a small business needs a security key
You don't need to give everyone a key on day one. Start where a takeover would hurt most:
| Who | Why first | Priority |
|---|---|---|
| Microsoft 365 or Google Workspace admins | One admin account can reset everyone else | Now |
| Directors | Targets for CEO fraud and fake payment instructions | Now |
| Finance staff | Approve payments and change supplier bank details | Now |
| Anyone with access to banking, payroll or domain registrar | Direct route to money or your website and email | Now |
| Everyone else | Passkeys on their phone or laptop give similar protection | Next, or use passkeys instead |
For staff who don't hold keys, passkeys stored on their phone or computer are a good alternative and cost nothing extra.
Two keys per person, and what they cost
A single key is a single point of failure. Register two for each person: one on the keyring, one locked away at home or in the office safe. If one is lost, they sign in with the spare and you revoke the lost one.
- Google Titan Security Key, USB-A/NFCGoogle Store SingaporeSGD 40
- Google Titan Security Key, USB-C/NFCGoogle Store SingaporeSGD 50
- Yubico Security Key Series (FIDO-only)Yubico Singapore store, in USDfrom US$29
- YubiKey 5 Series (FIDO2 plus other protocols)Yubico Singapore store, in USDfrom US$58
Two Titan USB-C keys per person, 3 peopleabout SGD 300
Prices from the Google Store Singapore and Yubico store pages, approximate, as of October 2026, before delivery.
For signing in to Microsoft 365 or Google Workspace, a FIDO2 key is enough. Multi-protocol keys such as the YubiKey 5 Series add features some businesses use for other systems. Pick USB-C or USB-A to match your laptops, and NFC if people will tap the key on their phone.
Enrolling keys in Microsoft 365 (Microsoft Entra ID)
Microsoft's guide to enabling passkeys (FIDO2) says passkeys, including those on FIDO2 security keys, are available in all Microsoft Entra ID editions, including Free, with no extra licence.
Enable the Passkey (FIDO2) method
In the Microsoft Entra admin centre, open the authentication methods policy, enable Passkey (FIDO2) and target a group such as "Security key users".
Set a passkey profile
Choose device-bound passkeys for this group, and optionally enforce attestation or allow only specific key models.
Users register both keys
Each user signs in to their Security info page and adds a passkey on each key. Microsoft requires an MFA sign-in within the past five minutes before registering.
Require phishing-resistant sign-in for the group
With Conditional Access (Entra ID P1, available to Microsoft 365 Business Premium customers; see our Conditional Access guide), require phishing-resistant MFA for admins and finance.
Keep a break-glass account
One emergency admin account, excluded from the new policy and stored securely, so a mistake doesn't lock you out of the tenant.
Enrolling keys in Google Workspace
Google's 2-Step Verification deployment guide lets admins enforce a method per organisational unit or group.
Put key users in their own group or organisational unit
So enforcement applies to admins, directors and finance only.
Users add both keys
In their Google Account security settings, under 2-Step Verification, they add each security key.
Check enrolment in reports
Admin reports show each user's 2SV status and number of security keys. Google notes the data can be delayed up to 48 hours.
Enforce Only security key
Under 2-Step Verification, Methods, choose Only security key. Google says this option now accepts both security keys and passkeys.
Set the suspension grace period
This lets a user who lost a key sign in with an admin-generated backup code for a limited time.
When a key is lost: a simple process
Write this down before you need it:
Lost key checklist
A security key alone can't sign in without the account's username and, where set, a PIN, so a lost key is a nuisance more than an emergency. Removing it promptly keeps it that way.
Do it yourself or get help?
Enrolling keys for three or four people is straightforward if you're comfortable in the admin console. The parts that go wrong are enforcement policies that lock out the only admin, and forgetting the spare keys.
Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users, cleans up admin roles and adds a break-glass account, blocks legacy sign-in and risky apps, and includes a leaver checklist with a before and after report. Our Password Manager Rollout (S$290) sets up Bitwarden or 1Password for your team, which pairs well with keys for the accounts that don't support them yet.
Frequently asked questions
Not for everyone, but yes for the accounts that matter most: admins, directors, finance staff and anyone who can move money or change bank details. Security keys resist phishing pages that defeat SMS codes and app prompts. Other staff can use passkeys on their phones or laptops, which give similar protection at no extra cost.
So losing or breaking one doesn't lock you out. Register both keys on every account, keep one with you and the other somewhere safe. If one goes missing, sign in with the spare, remove the lost key from your account and register a replacement as the new spare.
Yes. Microsoft Entra ID supports passkeys on FIDO2 security keys in all editions, including Free, with no extra licence, according to Microsoft's documentation. An admin enables the Passkey (FIDO2) method and users register keys on their Security info page. Conditional Access, included in Business Premium, can then require phishing-resistant sign-in.
As of October 2026, Google's Titan Security Key costs SGD 40 for USB-A with NFC and SGD 50 for USB-C with NFC on the Google Store Singapore. Yubico's Singapore store lists its FIDO-only Security Key Series from US$29 and the YubiKey 5 Series from US$58. Budget for two keys per person.
They sign in with their spare key and report the loss. An admin removes the lost key from their account and checks recent sign-ins. If both keys are lost, the admin issues a temporary access method, such as a backup code in Google Workspace. A lost key can't be used without the account details, so quick removal is usually enough.