You’re going to hear the word “passkey” a lot over the next year, ready or not. Microsoft has confirmed it’s making passkeys the default way to sign in to Microsoft 365 and Entra ID, starting September 2026. So it’s worth knowing what they are before the change shows up as a login prompt on your screen.
The short version: a passkey replaces your password. It’s easier to use and much harder for a criminal to steal.
So what is a passkey?
A passkey isn’t something you type or remember. When you set up an account, a pair of digital keys is created. One stays locked inside your device (your phone, laptop or a security key) and the other is held by the website or service. When you sign in, your device proves it has the private half, usually by checking your fingerprint, your face or your device PIN, and the two halves match up. Nothing you’d remember or type ever goes across the internet.
That’s the clever bit. There’s no password to phish, guess, reuse or leak in a data breach, because there’s no shared secret sitting on a server for anyone to steal.
What it’s like to use
This is where people are won over. Passkeys are simply easier than passwords.
- On a PC it’s usually a Windows Hello prompt: a quick face scan, fingerprint or PIN. No password box, no “forgot password” link.
- On a phone it’s Face ID, a fingerprint or your screen lock, and you’re in.
- In apps and browsers you’ll see “Sign in with a passkey” more and more, next to or instead of the password field. Your phone can even act as the key for a website on your laptop by scanning a QR code, which is handy if your work laptop doesn’t have a fingerprint reader.
Passkeys can also be backed up. Apple, Google and Microsoft all let you sync them so losing a device doesn’t lock you out, much like saved passwords sync today.
Why they’re so much safer
Passwords fail in predictable ways. People reuse them, write them down or get tricked into typing them into a fake login page. MFA helps, but codes sent by text or voice call can be intercepted or talked out of people, which is exactly why Microsoft is retiring them.
Passkeys are designed to beat this. Nothing is typed or sent, so a phishing site has nothing to capture. A passkey created for outsource.co.nz simply won’t work on a lookalike site, even if someone is fooled by the page. It’s tied to the real website, not to a secret a scammer can trick out of you.
One account, several passkeys
This catches people out. With a password there’s one, and everyone who needs access uses it. With passkeys, an account can have several, typically one per device. That changes how you think about losing one. There are two kinds:
Device-bound passkeys live only on the device that created them (a phone, a laptop or a physical security key) and never leave it. This is the more secure choice. If that device goes missing, you delete its passkey from your account and carry on. Every other device keeps working.
Synced passkeys are backed up across your devices through Apple, Google or Microsoft’s cloud. They’re convenient, but if a device holding one is lost and you can’t remote-wipe it, the safe move is to delete that passkey and start again. Every device using it then has to sign in again, a bit like a full password reset.
And here’s the catch: a passkey is only as secure as the device it’s on. If your phone PIN is 1234 and someone walks off with it, they may be able to use whatever’s on it. This is where Mobile Device Management (MDM) really earns its keep, enforcing decent PINs and biometrics and letting you wipe a lost device before anyone can use it.
A handy way to picture it is the key lockbox outside an Airbnb. The PIN opens the box, and the key inside opens the door. A synced passkey is like several lockboxes dotted around, each with a copy of the same key. Lose one and the others still work, but so does the one you lost for anyone who cracks it. (The picture gets a bit stretched once you remember an account can have several different passkeys, effectively several locks on the same door, but it’s a good start.)
Device-bound options worth knowing
Physical security keys such as YubiKeys let staff sign in by tapping or plugging in a small hardware key. They’re cheap compared with issuing phones, and because the passkey never leaves the key, they’re a strong, simple option for people who don’t want to use a personal phone for work.
Windows Hello can hold a device-bound passkey on a shared machine too, like a dispatch terminal in the warehouse or a shop-floor PC used by different people across a shift. You get passkey-level security without everyone needing their own key or device.
What’s changing in Microsoft 365
This isn’t “one day”. Microsoft has set dates:
- From 1 September 2026, Microsoft Entra ID (the sign-in system behind Microsoft 365) starts rolling out passkeys as the default. People using text or voice MFA codes will be prompted to register a passkey, though at first they can skip it.
- From 1 February 2027, Microsoft-provided SMS and voice authentication is retired. If you still want text or voice codes after that, you’ll need to set up your own third-party telecom provider through the Microsoft Security Store. Everyone else will be expected to use a passkey.
Microsoft’s reasoning is simple. Passkeys resist phishing, they come at no extra cost with every Entra plan, and as AI makes convincing phishing cheaper and easier, weaker sign-in methods are becoming a bigger liability.
What this means for your business
This change is coming whether you plan for it or not. The businesses that get ahead of it will roll passkeys out on their own terms, with a bit of communication and testing, a clear decision on device-bound versus synced, and MDM in place to back it up. The alternative is everyone getting “please set up a passkey” prompts at once with no idea why. It’s also worth having a simple recovery process your staff know about, which today usually means a helpdesk ticket if someone gets locked out.
We’ve also run a webinar on this, which you can watch below.
Not sure where your business stands on MFA and passkeys, or want help planning a smooth rollout? Book a free health check, or call us on 0800 688 768.