Passkeys are a new standard for signing into online services, designed to replace passwords and traditional multi-factor authentication (MFA) methods with something far more secure and user-friendly. For UK businesses, this shift represents a significant upgrade in defence against the most common cyber threats, particularly phishing.
What Passkeys Actually Mean for Your Business
At its core, a passkey is a digital credential that allows you to sign in to websites and applications using a cryptographic key pair, rather than a password. This technology is built on the FIDO (Fast Identity Online) Alliance's WebAuthn standard, an open protocol that ensures interoperability across different devices and services. When you create a passkey, your device, be it a laptop, phone, or a dedicated security key, generates a unique cryptographic key pair. The public key is stored by the service you are signing into, while the private key remains securely on your device.
When you sign in, your device uses this private key to prove its identity to the service. This process is inherently secure because the private key never leaves your device and is never transmitted over the internet. Instead, your device simply proves it possesses the private key. This contrasts sharply with passwords, which are sent to a server for verification, creating a significant vulnerability. For businesses, adopting passkeys means moving towards a truly passwordless sign-in experience that is tied to individual devices, making accounts much harder for attackers to compromise.
Why Passkeys Beat Traditional MFA for Security
Many businesses already use multi-factor authentication, which adds a second layer of security beyond a password. However, not all MFA is created equal. Traditional methods like SMS codes or push notifications from authenticator apps, while better than just a password, have known vulnerabilities. SMS codes can be intercepted via SIM-swapping attacks, where criminals trick mobile providers into transferring your phone number to their SIM card. Push notifications, common with apps like Microsoft Authenticator, can fall victim to 'MFA fatigue' attacks, where repeated prompts eventually lead a user to accidentally approve a fraudulent sign-in.
Passkeys, by contrast, offer true phishing-resistant MFA. This is because a passkey is cryptographically bound to the specific website or application it was created for. When you try to sign in, your device verifies that the website requesting authentication is indeed the legitimate one for which the passkey was generated. If a criminal tries to trick you with a fake login page (a phishing site), your device will recognise that the domain doesn't match and will refuse to use the passkey. This makes it virtually impossible for attackers to trick users into giving away their credentials, as the authentication process itself prevents interaction with malicious sites.
For businesses, this means a significant reduction in the risk of account takeovers, which are often the initial foothold for more sophisticated cyber attacks. The National Cyber Security Centre (NCSC) consistently highlights phishing as a primary threat vector, making phishing-resistant MFA a critical defence. By implementing passkeys, you are not just adding a second factor; you are fundamentally changing the authentication paradigm to one that is inherently more secure against the most common attack methods.
Rolling Out Passkeys in Microsoft 365 and Entra ID
For UK SMEs relying on Microsoft 365, passkeys integrate directly with Entra ID (formerly Azure Active Directory), offering a streamlined path to passwordless authentication. The primary method for passkeys in the Microsoft ecosystem is through FIDO2 security keys, which can be physical USB devices, or platform authenticators like Windows Hello for business (using PIN, fingerprint, or facial recognition) and Apple's Face ID or Touch ID on macOS and iOS devices.
Enabling passkeys in Entra ID involves configuring authentication methods policies in the Entra admin centre. Specifically, you will need to enable FIDO2 security keys. This allows users to register their compatible devices as passkeys for their Entra ID accounts. For instance, a user with Windows Hello enabled on their work laptop can register it as a passkey. From then on, they can sign into Microsoft 365 services by simply entering their Windows Hello PIN, scanning their fingerprint, or using facial recognition, without ever typing a password.
A pattern we frequently observe when helping clients enable phishing-resistant MFA is the initial user apprehension about changing their sign-in routine. Many users are accustomed to push notifications or SMS codes, and while they understand the security benefit, the shift to a device-bound credential requires clear communication and often a hands-on walk-through to build confidence. We find that a phased rollout, starting with a pilot group, allows us to address user questions and refine internal guidance before a wider deployment. This ensures that the transition to more secure authentication methods like passkeys is smooth and well-received across the organisation.
Once configured, users can manage their passkeys via their My Sign-ins portal, adding or removing devices as needed. Microsoft Authenticator passkeys are also becoming more prevalent, allowing users to store passkeys directly on their mobile device, secured by their device's biometric authentication. This gives users flexibility while maintaining the high security standards of FIDO2, making it a powerful tool in your overall cyber security services from Black Sheep Cyber strategy.
Common Pitfalls in Passkey Adoption
While passkeys offer substantial security benefits, their adoption isn't without potential pitfalls that businesses should anticipate and mitigate:
- Lack of User Education: The biggest hurdle is often user familiarity. Without clear communication on what passkeys are, how they work, and why they are more secure, users may resist the change or struggle with the new sign-in flow. Comprehensive training is essential.
- Incomplete Device Compatibility: Not all devices or browsers support passkeys equally. Some legacy systems or older hardware might not be compatible with FIDO2 standards, requiring a phased approach or alternative MFA for certain users or devices. This is where Intune device management can help ensure consistent device posture.
- Poor Recovery Mechanisms: If a user loses their device with their primary passkey, a robust account recovery process is critical. Without a clear plan, users could be locked out. Businesses need to establish secure secondary authentication methods for recovery, or ensure backup passkeys are available on other devices.
- Phased Rollout Challenges: While a phased rollout is recommended, it can complicate user management if some users are on passkeys while others still rely on less secure methods. Maintaining a hybrid environment requires careful administration and clear policies.
- Over-reliance on a Single Authenticator: While Microsoft Authenticator passkeys offer convenience, relying solely on one type of passkey (e.g., only mobile device passkeys) can create a single point of failure. Encouraging users to register multiple passkeys across different devices can enhance resilience.
Addressing these points proactively will ensure a smoother transition and maximise the security benefits of adopting passkeys across your organisation.
The Commercial Case for Phishing-Resistant MFA
Beyond the technical details, the commercial imperative for adopting phishing-resistant MFA like passkeys is clear. Cyber attacks, particularly those initiated through compromised credentials, lead to significant financial losses, reputational damage, and operational disruption for UK SMEs. The cost of a data breach can be substantial, encompassing everything from regulatory fines (e.g., from the ICO for GDPR non-compliance) to the expense of incident response, customer notification, and lost business.
Implementing phishing-resistant MFA is a proactive defence that significantly reduces the attack surface. It demonstrates a commitment to robust security practices, which is increasingly important for compliance frameworks like Cyber Essentials. Achieving Cyber Essentials certification, or even Cyber Essentials Plus, often requires strong authentication methods, and passkeys meet the highest bar for this. For many businesses, particularly those in regulated sectors or those handling sensitive customer data, demonstrating superior security is not just good practice; it is a competitive advantage and a contractual necessity.
Moreover, the user experience benefits of passkeys can improve productivity. Eliminating complex passwords and cumbersome MFA steps streamlines the sign-in process, reducing friction and support calls related to forgotten passwords or locked accounts. This efficiency gain, coupled with the enhanced security posture, makes a compelling business case for investing in passkey technology as part of your overall managed IT support strategy. It is about protecting your assets, your customers, and your future viability in an increasingly hostile digital landscape.
Frequently Asked Questions About Passkeys
Can passkeys be phished?
No, passkeys are inherently phishing-resistant. Unlike passwords or traditional MFA codes, a passkey is cryptographically bound to the specific website or application it was created for. Your device will only release the authentication credential if the domain requesting it precisely matches the domain it expects, making it impossible for a fake phishing site to trick your device.
Are passkeys stored in the cloud?
Passkeys are primarily stored securely on your device (e.g., laptop, phone, or security key) and protected by biometrics or a PIN. Some operating systems, like Apple's iOS and macOS, offer cloud synchronisation of passkeys across your devices using end-to-end encryption, ensuring convenience without compromising the private key's security.
Do passkeys require a specific browser?
Passkeys are based on the WebAuthn standard, which is widely supported by modern web browsers including Chrome, Safari, Edge, and Firefox. As the standard matures, support continues to expand. For a consistent experience, ensuring your organisation's devices run up-to-date browsers and operating systems is key for seamless passkey use.
What happens if I lose my device with a passkey?
If you lose a device containing your passkey, you will need to use an alternative recovery method. This could involve signing in from another device where you have a synced passkey, using a backup passkey (e.g., a physical FIDO2 key), or going through a secure account recovery process established by your IT team or the service provider. Proper planning for recovery is vital.
How Black Sheep Support Helps UK Businesses
Implementing advanced authentication like passkeys correctly requires expertise and a clear strategy. At Black Sheep Support, we help UK SMEs navigate the complexities of modern cyber security. We can assess your current authentication posture, design a phased rollout plan for passkeys within your Microsoft 365 and Entra ID environment, and provide the user training necessary for a smooth transition. Our engineers understand the practical challenges and can ensure your organisation leverages phishing-resistant MFA effectively.
If your business is ready to move beyond passwords and enhance its cyber security
and we'll discuss how to implement passkeys and strengthen your overall defence. We also handle hardware, broadband, mobile and networking, not just security.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers, or 15 to 20 minutes on your own, no commitment.
Want this handled for you? See Cyber security services.
Based in Brighton or Hove? We are too: see IT support in Brighton.
