Passkeys for Small Businesses: A Practical Rollout Guide

A small business does not need a large security team to have accounts worth stealing. A single mailbox can reset access to cloud files, invoices, social media, advertising accounts, a website domain, and payment services. If an attacker gets that mailbox password, the damage can spread well beyond one employee.

Passkeys offer a practical way to reduce one important risk: passwords and one-time codes being tricked out of people. They are now supported by the major account platforms many businesses already use. Microsoft is also moving Microsoft Entra ID customers away from its own SMS and voice authentication service, with a major retirement date approaching in 2027.

This guide explains what passkeys do, where they fit in a small business, how to choose between synced and device-bound credentials, and how to roll them out without locking staff out of essential systems. The recommendations are aimed at businesses using tools such as Google Workspace and Microsoft 365, not organizations with a dedicated identity team.

What is a passkey?

A passkey is a sign-in credential based on public-key cryptography. When a person registers one with a website or service, their device or passkey provider creates a cryptographic key pair. The service keeps the public key; the private key stays with the user's authenticator. During sign-in, the service sends a challenge and the authenticator proves possession of the private key.

The person approves the sign-in with the normal screen lock on their device: a PIN, fingerprint, face recognition, or another supported method. The biometric itself is checked locally by the device; it is not sent to the website as a fingerprint or face image.

The useful security property is that a passkey is tied to the legitimate website or service identity. A fake sign-in page cannot simply ask the browser to use the credential for the real domain. This is why passkeys are described as phishing-resistant. They also remove the need for people to invent, remember, reuse, or type a password for that account.

Passkeys use the FIDO standards, including WebAuthn. A business does not need to understand the protocol to deploy them, but it should understand the choices the account provider exposes.

Why this matters to a small business

Most businesses have a handful of accounts that can cause outsized disruption if compromised. These often include the main email tenant, domain registrar, website hosting, accounting software, payment processor, cloud storage, customer relationship management (CRM) system, social media accounts, and advertising platforms.

Those accounts are connected. Email is often the recovery route for other services. A compromised administrator account may let an attacker add another user, change payment details, export customer data, or reset access elsewhere. The goal is not to make every login complicated. It is to make the accounts that control the business harder to impersonate.

Passkeys are particularly useful where staff currently rely on passwords plus SMS codes. A text message can be redirected through a SIM-swap attack, and a one-time code can be relayed by a convincing fake login page. Passkeys bind the authentication to the real service instead of asking an employee to judge whether a page or message looks genuine.

They do not solve every security problem. A passkey cannot stop malware from controlling an already unlocked device, prevent someone from approving a fraudulent payment, or protect a stolen browser session by itself. Treat passkeys as a stronger sign-in control, not a replacement for device security, sensible permissions, backups, and staff procedures.

A change Microsoft 365 businesses should prepare for

There is a specific reason to review Microsoft sign-in methods now. Microsoft says that, from 1 September 2026, users enabled for SMS or voice in Microsoft Entra ID authentication-method policies or legacy MFA settings are automatically enabled for passkeys and nudged to register one the next time they complete an MFA sign-in. As of 1 November 2026, that rollout has already begun.

Microsoft's published retirement schedule then sets out two dates:

• 1 February 2027: Microsoft-provided SMS and voice authentication is retired for most users, including internal guest users. A user in scope whose only available MFA method is SMS or voice will be required to register a passkey during sign-in before continuing.
• 1 July 2027: The same Microsoft-provided SMS and voice retirement applies to Global Administrators and external users.

These dates apply to Microsoft Entra ID in Microsoft's public cloud. Microsoft says other cloud environments follow a separate schedule. Organizations with a genuine regulatory or operational need for SMS or voice can review Microsoft's supported telephony-provider route, but it should not be treated as a reason to delay moving other users to stronger authentication.

If your business uses Microsoft 365, do not wait for an employee to encounter a blocking sign-in prompt. Ask the administrator to identify who still relies on SMS or voice, check which passkey types are enabled, and plan a pilot. Microsoft's documentation says the FIDO2 passkey method is available across Entra ID editions, including Free, without an additional licence for the authentication method itself. Advanced access policies may have their own licensing requirements, so check the features in your plan.

Synced or device-bound: which passkey should you choose?

There are two common ways a passkey is stored. Neither is automatically right for every employee.

Synced passkeys

A synced passkey is stored by a supported passkey provider and made available on the person's other authenticated devices. Examples include Apple Passwords/iCloud Keychain and Google Password Manager. This is convenient for a small team: replacing a phone does not necessarily mean starting from scratch, provided the employee can securely recover access to the provider account.

The trade-off is that the passkey depends on the security and recovery of that provider account. NIST's digital identity guidance treats syncable authenticators as a distinct category with additional requirements for the sync service. A synced passkey can still provide phishing-resistant sign-in, but it is not the same as a private key that is permanently bound to one hardware device.

Device-bound passkeys

A device-bound passkey stays on one device or a dedicated FIDO2 security key. It is a better fit when the business wants tighter control over where a credential can be used. Hardware security keys are worth considering for administrator accounts, finance owners, domain registrars, and anyone who can change security settings for the whole company.

They introduce a practical responsibility: people can lose keys. Issue a second registered key or define another secure recovery method before requiring the first one. Do not keep the only spare key in the same laptop bag as the primary key.

A sensible small-business starting point is to allow supported synced passkeys for ordinary staff, while using device-bound keys for the most privileged accounts. The right choice depends on your risk, device management, service support, and any contractual or regulatory requirements. Some regulated environments specify particular authenticator properties; do not assume that any passkey automatically satisfies every MFA rule.

A safe rollout plan

Do not switch every account to passwordless sign-in in one afternoon. A short, staged rollout is easier to support and makes it less likely that a person will lose access during a busy working day.

1. Make an account list before changing settings

List the services employees use and identify the identity provider behind each one. Start with business email, file storage, finance, website and domain administration, CRM, payment services, social accounts, and cloud hosting. Mark who owns each account, whether it supports passkeys, who can reset access, and whether the account is shared.

Replace shared logins with named user accounts wherever the service allows it. A passkey belongs to a person, not to a department. Individual accounts make it possible to remove one employee's access without changing a password used by everyone.

2. Protect administrators first

Start with the people who can add users, reset passwords, manage domains, change payment settings, or control the email tenant. Give each administrator a separate account for administrative work where the platform supports it. Register at least two usable authentication methods for each critical administrator, and store any spare hardware key securely.

Keep a documented emergency-access process. It should identify who can authorize recovery, how identity is checked, where recovery material is stored, and how access is audited afterwards. An emergency account should not be a shared everyday login.

3. Pilot with a small group

Choose a few people who use different devices and browsers. Include someone who works mainly on a phone and someone who uses a desktop. Have them register a passkey, sign out, sign in again, and test the normal work applications they need.

Also test the awkward situations: a lost phone, a replaced laptop, a new browser, a staff member changing their phone platform, and a person who cannot use a biometric sensor. Confirm the support route before expanding the pilot.

4. Prepare recovery before enforcement

Recovery is part of authentication security. If the only way back into an account is a weak SMS number or an unverified help-desk request, an attacker may target that route instead. Decide how employees recover a synced passkey provider account, how a lost security key is revoked, and how an administrator is restored if their primary device is unavailable.

Keep recovery codes or spare keys in an approved, access-controlled place. Do not send recovery codes to a shared mailbox or store them in an unprotected spreadsheet. Test the recovery process with a pilot account, and record how long it takes and who must approve it.

5. Expand in groups and communicate clearly

Tell staff what is changing, why it is changing, and what they will see on their screen. Give them a short set of steps for their device type and a support contact. Roll out by team or group, monitor failed sign-ins, and keep an approved fallback available during the transition where policy allows it.

Only require passkeys for a group after the pilot proves that its devices, browsers, applications, and recovery process work. Remove weak fallback methods deliberately rather than leaving SMS as the permanent path simply because it is familiar.

6. Include contractors and offboarding

Contractors, temporary staff, and external collaborators need a clear account owner and end date. When someone leaves, disable the account, revoke active sessions where supported, remove their authentication methods, and transfer ownership of business assets. Do not assume that removing a passkey from a personal phone is the same as revoking the credential from the business service.

Where to configure passkeys

The exact controls depend on the account platform and the services your business uses. Use the current administrator documentation rather than following an old screenshot from a different plan.

Google Workspace

Google Workspace administrators can view and manage a user's passkeys and security keys from that user's security settings. Google's documentation shows that administrators can see the device or platform, when and where a key was added or last used, and whether it supports passwordless sign-in. They can also remove a user's passkey when necessary.

Google separates using a passkey as a second verification step from allowing a user to skip password entry. The password-skipping option is controlled by an administrator setting; if it is off, users can still use passkeys as a 2-Step Verification method. Decide which experience you want before telling staff that passwords will disappear.

Microsoft Entra ID

In the Microsoft Entra admin center, passkey controls are under Entra ID → Security → Authentication methods → Policies → Passkey (FIDO2). The current setup supports passkey profiles, which let an administrator choose device-bound or synced passkeys and target selected user groups. Start with a pilot group; do not apply a new policy to everyone until the supported devices and recovery process have been tested.

Microsoft also documents optional enforcement through Conditional Access authentication strength. This is an advanced policy choice, not a prerequisite for learning whether passkeys work for your staff. Check the licensing, device requirements, and effect on registration flows before enforcing it broadly.

Costs, trade-offs, and common mistakes

There is no single price for a business passkey rollout. The passkey capability may already be part of the identity platform you pay for; Microsoft, for example, says Entra ID FIDO2 passkeys do not require an additional licence. The main additional costs are likely to be optional hardware security keys, administrator time, staff onboarding, and support for older devices or applications. Hardware-key prices vary by model and supplier, so price the specific devices you intend to issue rather than relying on a generic estimate.

Before rollout, check these common failure points:

• One device, one credential, no backup. A lost or damaged phone can become an avoidable outage. Register a second method and test it.
• Personal and work accounts are mixed together. Decide which passkey provider is approved for work use and how staff will distinguish business credentials from personal ones.
• Shared accounts remain in use. Passkeys do not fix unclear ownership. Use individual identities and role-based access wherever possible.
• Old applications do not support passkeys. Some legacy tools may still need passwords or another authentication method. Document exceptions and put stronger controls around those accounts.
• Recovery is weaker than sign-in. A strong passkey policy is undermined if a caller can persuade support to reset an administrator account without proper checks.
• Passkeys are treated as a complete security programme. Keep devices patched, enable disk encryption and screen locks, protect sessions, review access, and maintain backups.

For higher-risk accounts, consider whether a device-bound security key is more appropriate than a synced credential. For lower-risk staff accounts, convenience and reliable recovery may be more important. Document the reason for the choice so the policy is understandable when staff or systems change.

How to measure whether the rollout is working

Do not measure success only by counting registered passkeys. A credential that employees cannot use, or cannot recover, will create workarounds.

Record a baseline before the pilot and review the same measures after each rollout group:

• Coverage: the share of active employees with an approved passkey registered, reported separately for administrators and other staff.
• Sign-in success: successful sign-ins, failed attempts, and the number of people who need to fall back to a password or another method.
• Support demand: password-reset tickets, passkey setup questions, lockouts, and average time to restore access.
• Recovery readiness: whether staff can use a backup method and how long a tested recovery takes.
• Account hygiene: former employees, unused accounts, stale authenticators, and privileged users who still rely on SMS or voice.

Compare results by team and device type. If one group has more failed registrations, find out whether the issue is device compatibility, confusing instructions, policy settings, or a recovery problem. Improve the process before enforcing it more widely. The goal is stronger account protection with fewer avoidable sign-in interruptions, not a passkey adoption number for its own sake.

Frequently asked questions

Are passkeys safer than SMS codes?

For phishing resistance, yes: a correctly implemented passkey is bound to the service's identity, while an SMS code can be entered into a fake site or intercepted through phone-number attacks. That does not mean passkeys prevent every form of account compromise. Device security and account recovery still matter.

Do employees need a fingerprint reader?

No. A supported device can use its screen-lock PIN or another local verification method. Some employees may prefer a hardware security key. The exact options depend on the operating system, browser, account platform, and authenticator.

Can a passkey be used on more than one device?

A synced passkey can be made available across devices through its provider. A device-bound passkey stays with one device or hardware key. Check which type your identity platform permits and how employees will recover access when changing devices.

Should a small business buy hardware security keys for everyone?

Not necessarily. A practical starting point is to prioritize administrators and other high-impact accounts, then use supported synced passkeys for other employees where the risk and provider controls make sense. Your industry, contractual obligations, and device environment may change that decision.

Conclusion

Passkeys are a useful improvement to business account security because they make phishing-resistant sign-in practical on devices employees already use. A small business does not need to replace every password on day one. It should begin with the accounts that control email, money, domains, customer information, and administration; choose an appropriate passkey type; and test recovery before enforcing a new policy.

For Microsoft Entra customers, the 2027 SMS and voice retirement makes this planning time-sensitive. For Google Workspace and other platforms, the same staged approach helps avoid account lockouts and unclear ownership. Start with a small pilot, measure support and sign-in outcomes, and expand only when the process works in real working conditions.

Further reading

• FIDO Alliance: Passkeys explained — how passkeys work, their phishing-resistant design, and the difference between synced and device-bound credentials.
• Microsoft Learn: Passkeys by default and SMS/voice retirement — the current Entra ID transition dates and preparation steps.
• Microsoft Learn: Enable passkeys (FIDO2) in Microsoft Entra ID — administrator configuration and passkey profiles.
• Google Workspace Admin Help: Manage a user's security settings — reviewing and removing a user's passkeys and security keys.
• Google Security Blog: Passkeys on phones, computers, and security keys — how Google Workspace administrator controls affect passwordless sign-in.
• NIST SP 800-63B-4 — current US federal digital identity guidance, including phishing resistance and syncable authenticators.

For a related look at securing connected business workflows, read our guide to AI agents for small businesses, including its advice on permissions and access controls.