Passkeys for Business: A Practical Deployment Guide

A physiotherapy clinic in Kingston, Ontario turned on multi-factor authentication two years ago. Yet in March, one of its physiotherapists typed her password and six-digit code into a fake sign-in page. The scammer relayed both in real time and read her mailbox for three days.

With a passkey, that attack fails: the passkey is bound to the real site, and the fake page has nothing to intercept.

The technology is mature, available from Microsoft and Google, and often at no extra cost. What makes the difference is the rollout. Here's how to do it in a small business without locking anyone out.

What is a passkey, and why use it at work?

A passkey is a sign-in credential based on FIDO standards, which the FIDO Alliance describes as phishing resistant and secure by design.

In its ITSAP.30.033 publication from April 2026, the Canadian Centre for Cyber Security explains that passkeys rely on the Web Authentication specification and that no password is sent to the service provider. The site only keeps a public key; the private key stays on the user's device or in their password manager, unlocked with a fingerprint, face or PIN.

For a small business, the benefits are concrete: no more passwords to steal, no more codes to relay, fewer calls about locked accounts. Our guide to choosing an MFA method compares every option; this article is about the rollout.

Synced or device-bound: what to choose for whom

There are two types of passkeys: synced passkeys, stored in a password manager or cloud account, and device-bound passkeys, such as a physical security key, which never leave the device.

The Cyber Centre warns that if the cloud account protecting a synced passkey has weak security, the passkey can be more easily obtained. Microsoft adds that synced passkeys don't support attestation, which verifies the authenticator's make and model.

Plan on two security keys per administrator: one on the key ring, one locked away at the office.

Rolling out passkeys in Microsoft 365

In Microsoft 365, passkeys are turned on in the Passkey (FIDO2) policy under Authentication methods in Microsoft Entra ID, and Microsoft states that no extra licences are required, even with the free edition.

The steps, according to Microsoft Learn:

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator, then go to Entra ID, Security, Authentication methods, Policies, Passkey (FIDO2).
2. Opt in to passkey profiles. You can't opt out afterwards; up to three profiles are supported, including the default profile.
3. Create one profile for administrators (device-bound, attestation enforced) and another for everyone else (synced and device-bound).
4. Target a pilot group first, and set "Allow self-service set up" to Yes.
5. Users register their passkey in Security info; they must have completed multi-factor authentication within the past five minutes. For new hires, a Temporary Access Pass can bootstrap registration.
6. Then require passkeys with a Conditional Access policy using the built-in "Phishing-resistant MFA strength," starting with administrators. Conditional Access requires Entra ID P1, included in Business Premium.

Rolling out passkeys in Google Workspace

In Google Workspace, passkeys can already serve as the second step of 2-Step Verification; administrators can also let users skip the password altogether.

• Skipping passwords. In the Admin console: Security, Authentication, Passwordless. The setting was off by default when Google launched it in 2023. Each user then has to turn it on and add a passkey to their account. Google notes that this doesn't deactivate or remove the existing password.
• Requiring a strong method. In the 2-Step Verification enforcement settings, the "Only security key" option now accepts both security keys and passkeys. Apply it to administrators first.
• Careful with the hardware-keys-only setting. If you restrict passkeys to physical security keys, Google warns that passkeys stored on phones or computers will stop working. Check who has enrolled a security key first.

The rollout plan for a small business

A successful rollout comes down to seven steps, in this order, over a few weeks rather than one Friday afternoon.

• Inventory: who has a company phone, who uses a shared workstation, which apps don't support passkeys yet.
• Administrators first: two security keys each, registered and tested.
• Pilot group of three to five people, including at least one who isn't comfortable with technology.
• One-page guide and a ten-minute walkthrough at a team meeting.
• Written recovery process: identity check by calling back the number on file and manager approval, then a Temporary Access Pass or backup key.
• Remove weak methods: text messages and voice calls, once everyone is registered.
• Make it mandatory for sensitive resources, then for everyone.

Recovery is the most attacked link: a scammer imitating an employee's voice on the phone can talk their way into a new passkey. Our article on deepfake voice fraud explains how to guard against it.

Pitfalls to avoid

The biggest pitfall is rolling out passkeys while leaving every old method in place: an attacker will simply pick the weakest one.

The Canadian Centre for Cyber Security is clear that the continued availability of alternative authentication methods poses a residual risk. It also recommends keeping devices updated and continuing to use multi-factor authentication wherever passkeys aren't available yet.

Other common pitfalls:

• synced passkeys in poorly protected personal Apple or Google accounts;
• external guests: Microsoft notes that passkey registration isn't supported for guest users;
• a username (UPN) change in Entra ID, which means deleting and re-registering the passkey;
• no backup key for administrators.

Passkeys protect your sign-ins, not your domain: a scammer can still send email in your name. Check that protection with our DMARC, SPF and DKIM checker, and see our MFA methods comparison to choose your fallback methods.

Our Microsoft 365 and Google Workspace audit reviews your authentication methods and Conditional Access before you roll out. Prefer to discuss it in person with your team? Request an on-site visit.