| A passkey is a sign-in credential that proves you control a registered cryptographic key without sending the private key to the service. It is unlocked with a device PIN, fingerprint or face scan, and it resists fake-login phishing because sign-in is bound to the legitimate service. |
Passkeys let staff sign in to supported services without typing a password. Depending on the provider and your policy, the key may stay on one authenticator or sync securely across approved devices. For a business, the work is deciding which passkey providers and devices to allow, which accounts to protect first, and how staff recover access or leave. Device security and recovery controls still matter.
Take an illustrative example. A staff member types her password into a fake Microsoft sign-in page and approves the prompt on her phone. The attacker relays both steps to the real service and keeps the session. With a passkey, the sign-in would fail at the lookalike page.
This guide covers how passkeys work, where they are stored, what they protect against and what they do not, Microsoft 365 support and licensing, rollout, recovery and cost. For the passwords that remain, see our guides to secure passwords and choosing a business password manager.
What are passkeys and how do they work?
A passkey replaces a typed secret with a key pair. When someone registers, their device creates a private key and gives the service only the matching public key. At sign-in, the service sends a random challenge, the device signs it after the person unlocks it, and the service checks the signature against the public key it stored.
The private key is not sent to the service during sign-in, and a copy of the public key is no use to an attacker because it cannot produce a signature. Each passkey is bound to the address of the service it was registered with, so the device will not sign for a lookalike domain. The person sees a PIN prompt, a fingerprint or a face scan.
How do passkeys compare with passwords and one-time codes?
| Method | What the service checks | Fake-login phishing |
|---|---|---|
| Password alone | A typed secret | Can be captured and reused |
| Password plus SMS or app code | A typed secret and a short code | Both can be relayed in real time |
| Password plus push approval | A typed secret and a tap on a phone | Number matching helps, but a proxy can still relay it |
| Passkey | A signature from a registered key | Designed to resist it, because sign-in is bound to the service |
Illustrative. Which methods meet your policy depends on the service and its configuration.
Passkeys are built on FIDO2, a family of open standards made up of WebAuthn, which browsers use, and CTAP, which lets a phone or security key answer for another device. Support still varies by service, browser and operating system.
Device-bound and synced passkeys: where is the key kept?
A device-bound passkey stays on its authenticator. A synced passkey is encrypted and synchronised through a provider so it can be used on the person’s other devices. Microsoft’s passkey documentation gives security keys and Microsoft Authenticator as device-bound examples, and Apple iCloud Keychain and Google Password Manager as synced examples.
- Device-bound. The private key is created and kept on one physical device, such as a security key, and does not leave it
- Synced. The key is encrypted on the device and synced through the provider account, so a replacement phone can pick it up
- Password manager. A password manager that supports passkeys is one possible synced provider, not a separate type of passkey
- Cross-device sign-in. A phone can approve a sign-in on a nearby computer without copying its credential to that computer
Device-bound credentials give tighter control for administrators, while synced passkeys are easier for staff who change phones. The choice affects recovery, so make it before registration starts.
Illustrative. Support depends on the service, provider, device, browser and your policy.
Record which provider each account uses. A synced passkey in a personal Apple or Google account leaves with the person, so decide early whether personal sync accounts are allowed for work.
How phishing-resistant are passkeys?
Passkeys are designed to resist fake-login phishing. They bind sign-in to the legitimate service, but attackers may still target your recovery process, devices or an already authenticated session. Phishing-resistant describes the sign-in exchange, not every route into an account.
The common attack they block is attacker-in-the-middle phishing, or AiTM. A proxy passes the password and code to the real login page and captures the session that comes back. Because a passkey signature is tied to the real address, the proxy has nothing it can replay.
New Zealand’s National Cyber Security Centre advises avoiding methods that are easy to bypass, such as one-time codes sent by SMS, and warns that codes generated in a mobile app are vulnerable to phishing or social engineering. Our guide to phishing scams covers the wider tactics.
Can malware still compromise an account?
Yes. A compromised device or vault may allow credential misuse or session theft even when the private key itself is not copied. Hardware protection can make key extraction harder, but the assurance depends on the authenticator, storage and implementation. Endpoint security, patching and the ability to revoke sessions stay part of the advice, and forwarding rules or app consents left by an earlier compromise survive a credential change, so clear them during the project.
Do passkeys replace multi-factor authentication?
A passkey with required local user verification can satisfy MFA, combining possession of the device with a PIN or biometric. It is a phishing-resistant way to meet an authentication policy, not a reason to remove MFA requirements. Keep the policy in place and check that each service recognises the method at the strength you need.
Biometrics are not mandatory. A device PIN can unlock a passkey, and where a fingerprint or face scan is used, the matching stays on the device rather than reaching the business or the service.
What assurance level do passkeys meet?
The US standard NIST SP 800-63B says synced passkeys can support AAL2 but not AAL3, because AAL3 requires keys that cannot be exported, along with other controls. A hardware key alone does not make a whole deployment AAL3. NIST is a useful technical reference rather than an obligation for New Zealand businesses.
How factors are chosen and enforced is covered in our multi-factor authentication guide, and which accounts are held to which policy belongs with identity and access management.
What does Microsoft 365 support, and what licence is needed?
The passkey method is available in every Microsoft Entra ID edition, including Free, without an extra method licence. Requiring passkeys through a Conditional Access authentication strength needs Entra ID P1, which Microsoft 365 Business Premium includes. Device management, risk-based controls and vault features can carry separate requirements.
| Layer | What it does | Licence to check |
|---|---|---|
| Passkey method | Lets users register and sign in with passkeys | Included in all Entra ID editions |
| Authentication strength | Requires a phishing-resistant method for chosen users and apps | Entra ID P1, included in Business Premium |
| Other controls | Device management, risk-based access, password vaults | Check each product separately |
What is Microsoft changing in 2026 and 2027?
From 1 September 2026, Microsoft began enabling passkeys by default for users set up for SMS or voice, with a registration campaign prompting them during sign-in. Under its published timeline, Microsoft-provided SMS and voice authentication retires on 1 February 2027 for users other than Global Administrators and external users, who follow on 1 July 2027. Internal guest users stay in the February group. Organisations that still need SMS or voice can configure a supported telephony provider. Checked 19 October 2026. Recheck the timeline before acting on it.
Which accounts should move first?
Administrator accounts first, then anything that moves money or holds payroll data. A rollout runs over weeks, and the accounts at the top of the list are the ones attackers aim at.
Administrator accounts
These control mailboxes, files and settings. Use device-bound credentials where suitable, with emergency access planned separately.
Finance and banking
Payment approval tools and anything that can change supplier bank details. Some banking portals use their own token or app instead.
Accounting and payroll
These hold bank accounts, IRD numbers and salaries for every person on staff.
Everyone else, in groups
Start with the team handling the largest volume of external email, because that is where phishing arrives.
What about systems that cannot use a passkey yet?
Keep them on the strongest workable protection and put them on a written list with an owner and a review date. Older line-of-business software, some banking portals, shared mailboxes and service accounts are common holdouts, and an account still using a password is the one an attacker looks for once the obvious targets have moved.
How do you roll out passkeys without disrupting staff?
Plan recovery and test supported apps before restricting anything. A rollout goes wrong when a working method is removed before its replacement is proven.
List systems and sign-in routes
Record every service staff use, including mobile apps and shared devices, and which accept passkeys.
Decide providers, devices and recovery
Agree approved providers and devices, whether personal sync accounts are allowed, and each person’s second route.
Enable the method for a pilot group
Turn on passkeys for a small group and keep existing methods available.
Test with the pilot
Check each supported app, cross-device and shared computer use, and a full lost-device recovery.
Expand in groups
Move administrators, then finance, then the rest of the business in team-sized groups.
Enforce for the users and resources in scope
After the pilot, require the approved phishing-resistant method for those users and resources. Test fallback and emergency access before restricting weaker options.
Do we still need the account password?
Registering a passkey does not automatically delete an Entra password or close every weaker sign-in route. Enabling a method and enforcing an authentication strength are separate steps. The underlying account may still have a password, depending on the platform, so check each vendor’s actual options before telling staff passwords are gone.
What do staff need to know before registering?
Tell them how sign-in will work, which devices they may use and how they get back in if a device is lost. Explain that a PIN works and what happens for anyone without a suitable smartphone.
Planning a rollout? Discuss your passkey rollout with Exodesk before changing sign-in policies.
What happens if someone loses their phone?
They use the second route agreed and tested before rollout. Plan that route before enforcing the first. Two devices using the same synced passkey and provider account do not necessarily give two separate recovery routes, so distinguish a separately registered credential from a synced copy.
- A second registered credential. On a separate authenticator, such as a security key, rather than another copy of the same synced passkey
- Provider ownership. Who controls the passkey provider account, and whether personal sync accounts are allowed
- Revocation and leavers. How a lost credential is revoked and sessions checked, and how access closes when staff leave, since a device wipe alone does not remove cloud credentials
- Emergency access. Named, deliberately managed accounts, not a shared administrator credential as the routine fallback
Who can approve a reset?
A named person, following a written process that matches the risk of the account. A callback to a number already on file is one useful check, but it is not enough assurance on its own for every privileged reset. Test the process once before go-live, including for staff without a suitable smartphone or biometric access.
What does a passkey rollout cost?
The passkey method itself is included in Microsoft Entra ID. The cost sits in planning, application checks, devices or security keys, registration time, recovery work and any licences needed for enforcement. Application compatibility, device readiness and recovery can matter more than headcount.
| Cost area | What to clarify |
|---|---|
| Microsoft licensing | Whether you need Entra ID P1 for authentication strength policies, or already have it in Business Premium |
| Devices and security keys | Which staff need security keys, and whether existing devices support the approved providers |
| Application checks | Which services accept passkeys and what happens to those that do not |
| Pilot and registration | Pilot size, session format and support for staff during the change |
| Recovery | Writing and testing the second route, emergency access and leaver process |
Ask for any quote in NZD with GST treatment, scope and date stated, and a pilot plan rather than a fixed completion date. Microsoft reports faster sign-in with synced passkeys in consumer Microsoft accounts, which is not a measured result for a business.
How can Exodesk help?
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. We help plan supported applications, approved devices, staff registration and recovery before sign-in policies change, and our cyber security services cover the controls around the credential.
NEXT STEP
Discuss your passkey rollout
Talk to Exodesk about supported applications, approved devices, staff registration and recovery before changing sign-in policies.
Frequently Asked Questions
Are passkeys safer than passwords?
Passkeys resist password reuse and fake-login phishing because sign-in uses a credential bound to the legitimate service. They do not remove every account risk. Your recovery process, device security and any alternative sign-in methods still need protection.
Do passkeys replace MFA?
A passkey used with required PIN or biometric verification can satisfy MFA. It changes how the requirement is met. Keep the relevant authentication policy in place and check that the service recognises the method at the strength you need.
Can a passkey be copied to another device?
Synced passkeys can be encrypted and synchronised through a provider. Device-bound credentials stay on their authenticator. Cross-device sign-in is another option, where a phone or security key approves a sign-in on a computer without copying the credential there.
What happens if someone loses their phone?
Use the separately tested recovery or backup route agreed before rollout. Revoke the lost authenticator where appropriate and check affected sessions. A second device using the same sync account may still depend on that provider, so test provider loss as well as device loss.
Do we still need the account password?
That depends on the platform. Registering a passkey does not necessarily remove the password. In Microsoft Entra, use supported policies to require the approved method for the resources in scope, while maintaining tested emergency access. Check other services individually.
Do passkeys cost extra in Microsoft 365?
The Entra passkey method is available without an additional method licence. Conditional Access authentication strength policies require Entra ID P1, which is included with Microsoft 365 Business Premium. Allow for devices or security keys, planning, recovery and staff support, and check whether other controls need further licences.
Can staff use passkeys on a shared computer?
In many cases, yes, by using an individual security key or supported cross-device sign-in from an approved phone. Check the browser, operating system, application and policy first. Keep sessions separate and signed out, and avoid saving personal or shared credentials into a communal browser profile.
Can malware still compromise the account?
Yes. Passkeys protect the sign-in exchange, but a compromised device can still enable session theft or misuse. The protection around a private key depends on the authenticator and provider, so keep device protection, patching and incident response in place.
Will passkeys work with all our business systems?
No. Check each application and sign-in route, including mobile apps and shared devices. Keep unsupported systems on the strongest workable protection with a named owner and review date, and do not remove a working method until the replacement and recovery route are tested.
Do staff have to use biometrics?
No. A device PIN can unlock a passkey, and where a fingerprint or face scan is used the matching stays on the device. Avoid making a personal phone the only supported option for staff who would rather not use one.
Can a Christchurch or Dunedin business get help with passkeys?
Yes. Exodesk has supported New Zealand businesses since 1989, and our Christchurch and Dunedin teams support businesses nationwide. Planning, configuration and registration sessions can be handled remotely, with on-site visits where a team would rather register together.
Contact us or call 0800 396 337 to talk about passkeys for your business.
