Passkeys for Business: Phishing-Resistant Sign-In for Microsoft 365 and Google Workspace

Passkeys are a way to sign in with a fingerprint, face scan or device PIN instead of a password plus a code, and they are the most practical form of phishing-resistant multi-factor authentication available to small businesses today. Unlike text-message codes or authenticator app codes, a passkey only works on the real website it was created for, so a fake login page cannot capture it. Microsoft 365 (Microsoft Entra ID) and Google Workspace both support them. The best rollout starts with administrators and finance staff, decides between synced and device-bound passkeys, and plans for lost phones before anyone needs it.

Why phishing-resistant MFA matters

Any MFA is far better than a password alone, and if you have not turned it on yet, start with our multi-factor authentication guide for business. But not all MFA is equal. CISA describes FIDO/WebAuthn authentication as the only widely available phishing-resistant option and recommends that organizations prepare to move to it.

The reason is how modern phishing works. A fake Microsoft 365 page can pass your password and your six-digit code to the real site in real time, and then keep the signed-in session. Text messages add another weakness: CISA notes that attackers can talk a mobile carrier into moving a phone number to their own SIM. Push approvals can be abused by sending prompt after prompt until someone taps "approve", which is why CISA calls number matching a useful interim step for organizations that cannot yet deploy phishing-resistant MFA.

Method	Phishing-resistant?	Notes
SMS or voice code	No	Vulnerable to phishing and SIM swapping
Authenticator app code	No	Can be typed into a fake page
Push with number matching	No, but better	Good interim step against prompt bombing
Passkey (synced or device-bound)	Yes	Tied to the real website
FIDO2 hardware security key	Yes	Device-bound passkey on a physical key

How passkeys work, in plain terms

A passkey is a pair of cryptographic keys. The website keeps the public half; the private half stays on your device or in your passkey provider and is unlocked with your fingerprint, face or PIN. According to the FIDO Alliance, each passkey is bound to the specific site or app it was created for, there is no shared secret to type into a form, and the server stores nothing that would let a thief sign in after a data breach.

For employees, the experience is simple: choose the account, touch the sensor or enter the device PIN, and you are in.

Synced vs device-bound passkeys

This is the main decision for a business:

• Synced passkeys are backed up and shared across the user's devices through a passkey provider, such as Apple Passwords (iCloud Keychain), Google Password Manager or a business password manager. They are easy to use and survive a lost phone, because the passkey is restored on the new device.
• Device-bound passkeys never leave the device they were created on. Examples are FIDO2 hardware security keys and passkeys stored in Microsoft Authenticator. They give the organization more control, but losing the device means registering a new one.

Microsoft's guidance is to treat synced passkeys as phishing-resistant, but with the same posture as other unattested authenticators, because the organization cannot verify which device or provider holds them. A practical split for most small businesses:

• Administrators, owners and finance staff: device-bound passkeys, ideally two hardware security keys each (one carried, one stored safely).
• Everyone else: synced passkeys or passkeys in Microsoft Authenticator, which are much better than codes and easy to adopt.

If your team already uses a password manager, check whether it can store passkeys; many can, which keeps everything in one managed place.

Enabling passkeys in Microsoft 365 (Entra ID)

Microsoft states that passkeys (FIDO2) are available in all Microsoft Entra ID editions, including the free one, with no extra license. The high-level steps:

1. Sign in to the Microsoft Entra admin center with at least the Authentication Policy Administrator role.
2. Go to Entra ID > Security > Authentication methods > Policies and select Passkey (FIDO2).
3. Opt in to passkey profiles when prompted. Profiles let you set different rules per group; Microsoft currently supports up to three, including the default. Note that the opt-in cannot be undone.
4. On the Configure tab, set Allow self-service set up to Yes.
5. Create profiles, for example "Admins: device-bound, attestation enforced" and "Staff: device-bound and synced".
6. Under Enable and Target, assign each profile to the right group, starting with a pilot.
7. Users register at Security info (mysignins.microsoft.com). They must have completed MFA within the past five minutes to add a passkey.
8. Once people are enrolled, use Conditional Access with the built-in phishing-resistant authentication strength to require passkeys for admin roles and sensitive apps.

Two details from Microsoft's documentation worth knowing: synced passkeys do not support attestation, and guest users cannot register passkeys in your tenant.

Enabling passkeys in Google Workspace

Google Workspace users can already add passkeys for 2-Step Verification. To let them sign in with a passkey instead of a password:

1. In the Admin console, go to Menu > Security > Authentication > Passwordless.
2. Open Skip passwords, choose an organizational unit if you want a pilot, and check Allow users to skip their password and authenticate with a passkey.
3. Each user then adds a passkey to their own account.

Turning this on does not remove existing passwords. Google also offers a Passkeys restriction setting to allow passkeys on hardware security keys only. Be careful: users whose passkeys are on phones or computers would lose that sign-in method, so check the "Security keys enrolled" column in the user security report first.

Plan for lost devices before you need it

Recovery is where passkey rollouts succeed or fail. Decide in advance:

• Two methods per person. Every user should have at least two ways to sign in, for example a passkey on their phone and one on their laptop, or two security keys.
• Identity checks for resets. Help desk resets should require confirming identity by a known channel (a call back to the number on file, or a video call), never just an email or text request.
• Temporary Access Pass in Microsoft 365. A Temporary Access Pass is a time-limited code an admin issues so a user can sign in once and register a new passkey. Microsoft's defaults are a one-hour lifetime and an eight-character code, and you can require one-time use.
• Remove the old method. When a device is lost, delete its passkey from the user's authentication methods, and include passkeys and security keys in your onboarding and offboarding checklist.
• Break-glass accounts. Keep emergency admin accounts with strong, separately stored credentials, excluded from policies that could lock everyone out.

A rollout plan that works

1. Week 1: enable passkeys, configure profiles and register the IT team and administrators.
2. Weeks 2–3: pilot with owners, finance and anyone who handles payments or sensitive data. Collect questions.
3. Weeks 4–6: open registration to all staff with a short guide (in English and Spanish), a 10-minute walkthrough and help desk availability.
4. After enrollment: require phishing-resistant authentication for admin roles, then for sensitive apps, and retire SMS where you can.

Passkeys remove the most common way accounts are taken over: a convincing fake login page. If you want help planning a rollout in Microsoft 365 or Google Workspace, including recovery and device policies with Microsoft Intune, request a free IT assessment. Core Florida IT works with businesses across Miami-Dade and South Florida.

Sources

• More than a Password: multifactor authentication (CISA)
• Implementing Phishing-Resistant MFA (CISA fact sheet)
• Passkeys (FIDO Alliance)
• How to enable passkeys (FIDO2) in Microsoft Entra ID (Microsoft Learn)
• Configure a Temporary Access Pass in Microsoft Entra ID (Microsoft Learn)
• Allow users to skip passwords at sign-in (Google Workspace Admin Help)