TL;DR:

  • Passkeys are phishing-resistant, require no shared secret, and are now supported across Chrome, Edge, Safari, and Firefox
  • Microsoft 365 and Google Workspace both support passkeys natively — setup is straightforward for businesses already using Authenticator or Google Prompt
  • Passkeys satisfy the Cyber Essentials MFA requirement, which matters for UK businesses pursuing certification
  • Staff losing their device is a manageable problem — backup codes and admin account recovery handle it
  • Roll out in phases: IT and leadership first, then the wider team, over 4—6 weeks

Passwords are a shared secret. Your staff create one, your system stores a version of it, and somewhere in between — a phishing email, a data breach at a third-party site, a reused password — that secret gets out. Passkeys eliminate the shared secret entirely. That’s not a marketing claim; it’s how the underlying cryptography works.

For UK small businesses trying to stay ahead of credential-based attacks — which remain the most common entry point for ransomware and business email compromise — passkeys are the most meaningful security upgrade available right now, and the good news is that rolling them out has got considerably easier in the past 18 months.

What a Passkey Actually Is

A passkey is a cryptographic key pair stored on your device. When you register with a service, your device generates a public key (shared with the service) and keeps the private key locked on the device. When you log in, the service sends a challenge, your device signs it with the private key, and the service verifies it with the public key.

The private key never leaves your device. There is no password database to breach. Phishing doesn’t work because the passkey is bound to the exact domain it was created for — a fake login page gets nothing useful. This is the FIDO2/WebAuthn standard, backed by Apple, Google, and Microsoft, and it’s why passkeys are described as “phishing-resistant” rather than just “strong.”

Biometric unlock (Face ID, fingerprint, Windows Hello) is what you use to access the private key on your device. The biometric data also never leaves the device — it’s just the local key to unlock your local credential.

Microsoft 365: Enabling Passkeys via Entra ID

Microsoft’s passkey support runs through Entra ID (formerly Azure AD) and the Microsoft Authenticator app. Here’s how to get there.

Step 1: Enable passkeys in Entra ID. In the Entra admin centre, go to Protection > Authentication methods > Policies. Find “FIDO2 security key” and “Microsoft Authenticator” — both need to be enabled. For most SMEs, enabling for all users is the right call, but you can target a pilot group first.

Step 2: Configure Conditional Access. This is the part that actually enforces phishing-resistant MFA. Create a Conditional Access policy requiring “Authentication strength: Phishing-resistant MFA” for all cloud apps. This ensures that even if a user has an older MFA method configured, they’re pushed toward passkey or FIDO2 key use.

Step 3: Staff setup. Users go to mysignins.microsoft.com, sign in, and add a passkey under Security info. On a phone, they’ll use Microsoft Authenticator; on a PC with Windows Hello, they can register a device-bound passkey directly. The process takes under two minutes once you’ve done it once.

Practical note: if your users are on Microsoft 365 Business Premium, you already have the Entra P1 licence needed for Conditional Access. If you’re on Business Standard, Conditional Access requires an Entra ID P1 add-on.

Google Workspace: Passkeys and Security Keys

Google has had passkey support in consumer accounts since 2023, and Workspace followed. The admin controls live in the Google Admin console under Security > Authentication > 2-Step Verification.

Enable “Allow users to enrol in Google passkeys” and, if you want to enforce it, set “2-Step Verification enforcement” to On with “Advanced Protection” or “Passkeys” as the required method.

Staff set up passkeys at myaccount.google.com > Security > Passkeys. On Android, this saves to Google Password Manager automatically. On iPhone, it goes to iCloud Keychain. Either way, the passkey syncs across the user’s devices within that ecosystem.

If you have users with corporate-issued devices, consider deploying hardware security keys (YubiKey 5 NFC is the most common choice at around £45—£55 each) as an alternative for staff who don’t use personal phones for work. Security keys are also FIDO2-compliant and fully phishing-resistant.

Password Manager Integration: 1Password and iCloud Keychain

Staff who use 1Password (version 8 or later) can store passkeys there, which is particularly useful for cross-platform users — a passkey created on a Windows machine and saved to 1Password is accessible on their iPhone too, without being tied to a specific OS ecosystem.

iCloud Keychain does the same for Apple-only users. If your team is mixed (some on Android, some on iPhone, some on Windows), 1Password is the cleanest cross-platform passkey manager right now. Bitwarden also added passkey support in 2024, so there are options beyond the big three OS providers.

Browser Support: Not a Blocker Anymore

As of 2026, passkeys work on:

  • Chrome (Windows, macOS, Android, ChromeOS) — full support
  • Edge (Windows, macOS) — full support, with Windows Hello integration
  • Safari (macOS, iOS) — full support via iCloud Keychain
  • Firefox — support added in version 122; works with external authenticators (hardware keys, cross-platform managers)

The only real edge case is very old browsers or enterprise environments locked to Internet Explorer compatibility mode — but if that describes you, passkeys are the least of your security concerns.

Common SME Objections, Addressed

“What if a staff member loses their phone?” This is the most common worry, and it’s the most manageable. Passkeys in iCloud Keychain or Google Password Manager are synced — a new iPhone or Android device with the same account recovers them automatically. For Microsoft Authenticator, there’s a cloud backup option. For hardware security keys, you register two and keep one as a spare. And as the IT admin, you can revoke a user’s registered passkeys in Entra or Google Admin and force them to re-enrol. Backup codes for emergency access are also worth distributing during rollout.

“What if staff need to log in on a shared or new device?” Passkeys support a “cross-device” flow where you use your phone to authenticate on a nearby computer — a QR code appears on screen, you scan it on your phone, approve the biometric, and you’re in. It sounds fiddly but takes about 15 seconds in practice.

“Do we need to replace passwords immediately?” No. Passkeys can coexist with passwords during transition. The goal is to enrol passkeys first, then progressively restrict password-only sign-in via Conditional Access or Workspace policy over time.

A Phased Rollout for a 10—50 Person Business

Week 1—2: IT and leadership. Enable passkeys in your identity provider, enrol IT admin accounts first, test the full flow including account recovery. Fix any friction before it hits the wider team.

Week 3—4: Early adopters. Identify 5—10 people who are comfortable with tech — they’ll surface edge cases and become internal champions who can help colleagues later.

Week 5—6: Full team. Schedule 15-minute onboarding sessions (in-person or video call) per team. Have a one-page instruction sheet ready. The process is genuinely simple once someone walks through it once.

Ongoing: Monitor sign-in logs for password-only authentications. Use Entra or Google Admin reporting to identify any accounts that haven’t enrolled. Follow up directly — there’s usually a device compatibility issue or a simple misunderstanding.

Cyber Essentials Alignment

The UK government’s Cyber Essentials scheme requires multi-factor authentication for cloud services. Passkeys satisfy this requirement — they are, by design, multi-factor (something you have: the device; something you are: the biometric). If your business is working toward Cyber Essentials or Cyber Essentials Plus certification, deploying passkeys across your primary productivity suite is directly useful, not parallel work.

Certification also requires that MFA can’t be bypassed — which is why the Conditional Access policy step in the Microsoft 365 section matters. Enabling passkeys but not enforcing them via policy doesn’t get you full credit.

The Bottom Line

Password managers helped, but they still involve shared secrets and are only as strong as the master password. Passkeys are a structural improvement — they remove the credential from the attack surface entirely. The platforms your business already pays for (Microsoft 365, Google Workspace) support this today, the browsers your staff already use support it, and the rollout process is measured in weeks, not months. There is no good reason to wait.