Key takeaways

  • Passkeys use public-key cryptography tied to the real website, so a fake sign-in page cannot capture them. The FIDO Alliance describes them as phishing-resistant.
  • Microsoft Entra ID supports synced passkeys and device-bound passkeys on FIDO2 security keys and in Microsoft Authenticator, with no extra license for the feature.
  • Use passkey profiles to give administrators and executives device-bound passkeys with attestation, and broader staff a simpler option.
  • Pilot first, then expand by group, and enforce with a Conditional Access authentication strength policy only after most users are registered.
  • Plan recovery before launch. Most failed rollouts stall on lost devices and new hires, not on the technology.

Start with the answer: roll passkeys out in stages. Pick the passkey types you will allow, pilot with a small group, register users in waves, then enforce passkey sign-in for sensitive resources once most people are enrolled. Decide recovery and onboarding before you begin. Passkeys are worth the effort because they resist phishing, the attack that defeats passwords and many one-time codes.

What a passkey is

A passkey is a sign-in credential based on the FIDO standards. The device creates a pair of cryptographic keys. The private key stays on the device or in the passkey provider. The service keeps the public key and checks a signature each time. Because the credential is bound to the real website address, a look-alike phishing page gets nothing it can reuse. The FIDO Alliance, which publishes the standards, calls passkeys phishing-resistant and says they are faster to use than passwords.

Choose the type: device-bound or synced

The Microsoft Entra documentation lists two families. Device-bound passkeys stay on one piece of hardware, such as a FIDO2 security key or Microsoft Authenticator. Synced passkeys are backed up by a native or third-party passkey provider and move between a person's devices. Device-bound gives stronger assurance and a clear inventory. Synced gives easier recovery and less support work. Most organizations use both, by role.

  • Administrators and other high-privilege accounts: device-bound passkeys, with attestation enforced so only approved authenticator models register.
  • Executives and finance staff: device-bound, for the same reason, since they are targeted by fraud.
  • General staff: synced or device-bound, whichever your support team can sustain.
  • Shared or kiosk workstations: security keys that people carry, not credentials stored on the machine.

Roll out in six steps

  • Inventory. Find which applications sign in through Microsoft Entra ID and which do not. Legacy applications that use stored passwords need a separate plan.
  • Check devices. Confirm operating system and browser versions support passkeys. Microsoft notes minimum Authenticator versions when a profile covers both types.
  • Configure. In the Entra admin center, enable passkey profiles, set attestation and passkey types, and target each profile at a group.
  • Pilot. Start with IT and a few volunteers from each department. Record every support question; they become your help page.
  • Register in waves. Use short guides and a deadline. Pair registration with an existing sign-in step so users do not need to hunt for the setting.
  • Enforce. Create a Conditional Access authentication strength policy that requires passkeys for sensitive resources, starting with administrators.

Communication matters as much as configuration. Tell people why the change is happening, what they will do on the day, and who to call. A two-minute video of the registration steps on each major device type removes most questions. Name a champion in every department, someone respected who registers early and helps colleagues. Offer drop-in sessions during the first week of each wave. Staff who travel, work shifts or use shared devices need their own instructions, so ask their managers what the day looks like before you finalize the guide.

Pitfalls that stall rollouts

  • No recovery plan. A user who loses a security key needs a safe way back. Define a verified process, such as a time-limited access pass issued after identity checks, and train the help desk to resist social engineering.
  • Enforcing too early. If you require passkeys before people register, you create lockouts and angry executives. Measure registration first.
  • Leaving the old methods on. Phishing-resistant sign-in does little if attackers can still use a password plus text-message code. Retire weak methods group by group after enforcement.
  • Ignoring attestation. Without key restrictions, any authenticator can register. For privileged accounts, restrict to known models.
  • Forgetting non-human and legacy accounts. Service accounts and old applications will not use passkeys. Inventory them and move them to managed identities or stronger controls.
  • Mixing personal and work passkeys. Decide whether staff may store work passkeys in personal password managers. A synced provider outside your control changes your recovery and offboarding story.

Offboarding and device loss

Write the exit steps now. When someone leaves, remove their passkey registrations, revoke sessions and recover any security keys. When a phone is lost, the user should remove it from their account through a verified channel and register a replacement. Test both procedures before you enforce.

Measure progress

Track registration rate, share of sign-ins using passkeys, help desk tickets about sign-in and the number of accounts that can still sign in with a password. Report these to leadership monthly. When passkey sign-in is the norm and weak methods are off, your exposure to credential phishing falls sharply, and so does the cost of resetting passwords.

Our team can design the profiles, run the pilot and write the recovery procedures for your environment.

Sources

This article is general information, not legal advice. Standards and vendor documentation change; confirm current requirements with your regulator, counsel and IT provider. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity