Careful staff can still lose an account, because a convincing fake sign-in page collects a password and the six-digit code that goes with it. Passkeys remove that weakness, and the major business platforms now support them. What is left for you is a decision about the next step after two-step sign-in: which kind of passkey to allow, how to recover from a lost passkey, and what happens on the day someone leaves.
This guide explains the choice that matters most (synced or device-bound) and sets out the recovery and offboarding rules to write down first. It assumes you already use two-step sign-in; if not, start with our two-step sign-in rollout for a small team.
What a passkey changes
A passkey is a pair of cryptographic keys. The private key stays on the user's device and the service stores only the public key. According to passkeys.dev, a community resource run by members of the FIDO Alliance and the W3C, passkeys are unique for every service, so they cannot be reused, and browsers and operating systems make sure a passkey is only ever used for the site it was created for.
That is the security gain. Microsoft's documentation adds that sign-in requires the user to be present and unlock the passkey with a face, fingerprint or PIN. A fake page cannot receive it, so there is nothing to type into a fake page.
Compare that with the codes most companies use today. CISA's fact sheet on phishing-resistant MFA (October 2022) lists phishing, push bombing, SS7 weaknesses and SIM swapping as ways attackers get past codes sent by text message or approved in an app, and calls FIDO/WebAuthn the only widely available phishing-resistant option. The paper is about four years old, but the attacks it describes remain current. NIST's SP 800-63B-4, published in July 2025, states that passwords, one-time codes and out-of-band codes are not phishing-resistant.
NIST's rules are written for US federal systems. They do not bind a company, but they are a sound benchmark for what "strong" means.
Where passkeys start
Use the account order from our two-step article, linked above: email, money, administration, then the rest. What is different with passkeys is the first group. CISA names system administrators as a sensible first group and advises starting with services that already support FIDO, such as hosted mail and single sign-on. Give passkeys to administrators first, because their accounts are the ones where a phished code does the most damage. Support for passkeys varies by provider and this guide does not list who has it, so check each vendor's help page. Where passkeys are missing, keep your current second step.
Synced or device-bound
This is the choice that shapes everything else. Microsoft describes two types. A device-bound passkey lives on one device, such as a hardware security key, and never leaves it. A synced passkey is stored encrypted in a cloud provider's service, for example iCloud Keychain or Google Password Manager, so it works on every device the person signs in to.
The trade-off is plain. Synced passkeys survive a lost phone and are easy for staff, but the key can be copied by design. Device-bound passkeys are harder to steal and let you verify what kind of device was registered, but a lost key means a recovery case. NIST makes the same point: because syncable authenticators need an exportable key, they cannot be used at its highest assurance level, AAL3.
Microsoft's guidance maps onto a company like this:
- Hardware security keys, or passkeys in Microsoft Authenticator, for people with elevated privileges. Microsoft notes the costs of equipment, training and helpdesk work when keys are lost.
- Synced passkeys for most other users, which Microsoft calls a convenient, low-cost alternative to traditional MFA.
- Attestation, which proves the make of the device at registration, works only with device-bound passkeys. In Entra, switching it on blocks synced passkeys, and Microsoft's own example profile for IT admins and executives enforces attestation with device-bound keys.
Google Workspace is similar but narrower. An admin must first enable skip password before a passkey can replace the password, and Google's help page notes that on some Workspace accounts users may not be able to sign in with a passkey alone, though they can still use it as a second factor. The "Only security key" policy accepts both security keys and passkeys, which Google says have the same level of phishing protection. The lesson: choose the passkey type per group, device-bound for administrators and synced for everyone else, and check your admin console before you promise staff a passwordless sign-in.
Recovery when the passkey is lost
With passkeys, the failure to plan for depends on the type. Lose a device-bound key and you lose one credential. Lose access to the cloud account that syncs passkeys and you can lose every passkey stored in it at once. Decide these points in advance:
- Two passkeys per person, in different places. A synced passkey on the daily device and a second method, such as a security key in a locked drawer. Do not rely on one sync account alone.
- A named person who can issue a way back in. In Microsoft Entra, a Temporary Access Pass is a time-limited code that lets a user sign in to set up new passwordless methods, and Microsoft says it makes recovery easier when someone loses a strong method. In Google Workspace, Google's 2-Step Verification guide describes a grace period in which a user can sign in with a backup verification code that an admin generates.
- Identity checks before recovery. The recovery path becomes the attack route. Require a video call or a second person to confirm the request, and record who approved it.
- A break-glass admin account with a device-bound key stored offline, so a broken sign-in policy cannot lock everybody out. Test it twice a year.
- Do not turn codes and SMS off yet. Run passkeys beside the old method for a few weeks. Remove the old method only for accounts where everyone has two working passkeys.
When someone leaves
Passkeys make offboarding easier if they belong to the company. NIST's appendix on syncable authenticators says federal enterprises should control the sync service through agency-managed accounts and use device management to keep keys from reaching unauthorised devices. The lesson applies to any size: register work passkeys only in a company-managed account, such as the work Google or Microsoft profile, and avoid personal iCloud or Google accounts. A passkey saved in a personal account goes home with the employee.
On the last day, remove their registered passkeys and security keys. In Google Workspace an admin can view and remove a user's passkeys, with details on when and where each was added and last used. Collect any hardware keys, and add the step to your new employee access checklist.
Where this advice does not fit
If a vendor you depend on offers no passkeys, keep a strong second step there and store the password properly, as in our password manager rollout. Hardware keys cost money and add helpdesk work, so they suit a company with a handful of administrators better than one with fifty. Passkeys also do not cover the API keys and tokens that systems use to talk to each other; if one of those leaks, follow the first-hour steps for a leaked API key. Platform settings change quickly; we checked the vendor pages above on 4 November 2026, so recheck before you configure anything.
Your next step this week
Pick the administrator accounts and your own mailbox. Register two passkeys for each, a device-bound one and a backup, then write a half-page recovery note naming who can issue a temporary code, how identity is checked and what happens to a leaver's passkeys. When that works, widen the rollout to all staff mailboxes. For a second opinion on the plan, or help turning sign-in, offboarding and access reviews into one repeatable process, talk to our consulting team.
Sources
- passkeys.dev (FIDO Alliance and W3C community), 2026, What are passkeys?. Page last updated 21 September 2026.
- Microsoft, 2026, Passkeys (FIDO2) authentication method in Microsoft Entra ID. Last updated 6 April 2026. Claims about Microsoft products are Microsoft's.
- Microsoft, 2026, How to enable passkeys (FIDO2) in Microsoft Entra ID.
- Microsoft, 2026, Temporary Access Pass in Microsoft Entra ID. Last updated 4 March 2026.
- Google, 2026, Protect your business with 2-Step Verification, Deploy 2-Step Verification, Manage a user's security settings and Sign in with a passkey instead of a password. Claims about Google Workspace are Google's.
- NIST, July 2025, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management. Sections 2.2 and 3.2.5, Appendix B. US federal requirements, used as a benchmark only.
- CISA, October 2022, Implementing Phishing-Resistant MFA. Older than 24 months; still valid because it describes attack methods (phishing, push bombing, SIM swap) that remain current and it is consistent with NIST's 2025 text.
