Passkeys for Microsoft 365 business accounts
A phishing-resistant sign-in option for Microsoft 365. Inventory compatible devices, pilot with a small group, and plan recovery for a lost device before you expand it.
Updated October 19, 2026. Published July 22, 2025.
A passkey is a sign-in method that uses a cryptographic key instead of a password the person types into a page. Microsoft describes passkeys as resistant to phishing because the sign-in is tied to the real site and does not give a reusable password to a lookalike login page. In a Microsoft 365 business tenant, a passkey is one authentication option next to the methods people already use. It does not mean an account cannot be misused if a device is unlocked, lost, or shared, and it does not remove the need to decide who is allowed to sign in.
Microsoft’s documentation explains how passkeys work on Windows and how an organization can review authentication methods, including older text-message and voice sign-in. See Microsoft’s passkey guidance and the note on SMS and voice authentication changes.
Before you turn it on for everyone
- List the phones and computers people use, and the sign-in methods already allowed.
- Start with a small pilot, not the whole company on the same day.
- Decide how a lost phone or laptop is recovered, including access for administrators.
- Expand only after that pilot can sign in and get back in when a device is gone.
FSCS can help plan a practical rollout alongside Microsoft 365 support and cybersecurity.
Ready for IT to feel less complicated?
Tell FSCS what is changing, what is frustrating your team or what you want to improve.