Article Summary: A passkey lets you sign in to an app or website using the same fingerprint, face, or PIN you use to unlock your phone or laptop, with no password to type. It’s built on a security standard called FIDO that can’t be phished, because the passkey only works on the real site and there’s no password to steal or reuse. Most major platforms and a growing list of business tools support passkeys, and Microsoft 365 includes them at no extra cost. For most businesses, it’s worth starting to roll them out, beginning with the most sensitive accounts.
Passwords are the weak point in most businesses.
People reuse them across accounts, write them on sticky notes, and type them into convincing fake login pages without realizing it.
Passkeys are the technology built to replace passwords, and they fix the parts that cause the most trouble.
A passkey lets you sign in with the same fingerprint, face scan, or PIN you already use to unlock your phone or laptop. There’s no password to type, so there’s nothing for an attacker to steal, guess, or trick out of you.
Let’s look at what passkeys are, why they’re so much harder to attack than passwords, and whether your business should start using them.
What is a passkey?
A passkey replaces your password with your device’s own security.
Instead of typing a password, you prove it’s you the same way you unlock your phone: a fingerprint, a face scan, or a PIN.
When you set up a passkey for a website, your device creates two matching keys.
The private key stays locked on your device and never leaves it.
The public key is stored by the website.
When you sign in, the site sends a challenge that only your private key can answer, your device answers it once you confirm with your fingerprint or PIN, and you’re in. The website never sees a password, because there isn’t one. This approach comes from a standard called FIDO, which Apple, Google, and Microsoft all build on.
Why passkeys are harder to attack than passwords
Passkeys are phishing-resistant: they are tied to the legitimate website or app and do not expose a reusable password for a convincing lookalike page to capture. That makes them a strong option for reducing common credential theft, though no sign-in method removes the need for sound device security, access reviews, and recovery procedures.
Where you can use passkeys already
Support has spread fast.
You can already sign in with passkeys to Microsoft, Google, and Apple accounts, plus a growing list of banks, password managers, and business tools.
Apple, Google, and Microsoft have built passkeys into their phones, laptops, and browsers, so the device in your pocket can already store and use them.
There are two types worth knowing.
A synced passkey is backed up to your Apple, Google, or Microsoft account, so it works across all your devices and you’re covered if you lose one.
A device-bound passkey stays on a single device, like a physical security key you plug in, which is the most locked-down option and a common pick for sensitive accounts.
Should your business use them?
For most Canadian SMBs, passkeys are worth piloting first with administrators and other high-risk accounts. Confirm that your Microsoft 365 tenant, identity provider, browser mix, and licence plan support the exact sign-in method you intend to use; availability and configuration options vary.
Keep a documented fallback process. Decide who can approve recovery, how a lost or replaced device is verified, and how quickly former staff lose access. A well-run recovery process is part of security, not an exception to it.
The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations continue to recommend multi-factor authentication alongside strong access and device management practices.
What to watch out for
Passkeys aren’t magic, and a few things are worth planning for.
- Account recovery. If someone loses the only device with their passkey and has no backup, they can get locked out. A synced passkey or a second registered device fixes this, but you have to set it up ahead of time.
- Not everything supports them yet. Support is growing fast, but some older systems and smaller vendors still rely on passwords, so you’ll run both side by side for a while.
- Shared devices and logins. Passkeys are tied to a person and their device, so any shared computers or shared accounts need their own plan.
Frequently Asked Questions
What is a passkey in simple terms?
It’s a way to log in using your fingerprint, face, or PIN instead of a password. Your device proves it’s you to the website, and no password is ever typed or stored.
Are passkeys safer than passwords?
Yes. They can’t be phished, there’s no password for a hacker to steal in a data breach, and there’s nothing to reuse or forget. Security agencies like CISA recommend FIDO-based logins, which is what passkeys are, as the strongest widely available option.
What happens if I lose the device with my passkey?
If it was a synced passkey, it’s backed up to your Apple, Google, or Microsoft account and still available on your other devices. If it was device-bound and you have no backup, you’d use a recovery method to get back in, which is why setting up a second passkey or device in advance matters.
Does Microsoft 365 support passkeys?
Yes. Passkeys are available through Microsoft Entra at no extra cost, including the free tier. Staff can use a passkey in the Microsoft Authenticator app, a security key, or their device.
Do passkeys replace multi-factor authentication?
A passkey can count as multi-factor authentication on its own. Unlocking it needs both your device (something you have) and your fingerprint, face, or PIN (something you are or know), so it covers two factors in one step and can replace the old password-plus-text-code routine.
—
This article is republished with permission from The Technology Press. and adapted by My IT Guy for a Canadian SMB audience.
