Passwords plus a push notification stopped being enough once attackers started running phishing kits that relay MFA in real time. Passkeys in Microsoft Entra ID fix that problem at the root, because the credential is bound to the real Microsoft sign-in page and simply won’t work on a fake one. The good news for smaller organizations: passkeys are available in every Entra ID edition, including Free, with no extra license.
This is the phased plan I use to move a 20 to 500 person organization from passwords and push notifications to passkeys, without a flood of helpdesk tickets.
Passkey types in plain English
A passkey is a FIDO2 credential: a private key stored on a device, unlocked with a PIN or biometric, that signs a challenge from Microsoft Entra ID. The site never sees a shared secret, and the key only works for the real domain. Entra ID supports two broad kinds:
Type
Where it lives
Strengths
Trade-offs
Good fit
Device-bound: security key
A hardware key such as a USB or NFC key
Strongest assurance, can enforce attestation, works on shared PCs
Costs money, can be lost
Admins, emergency access, shared workstations
Device-bound: Microsoft Authenticator
The user’s phone, inside Authenticator
No hardware to buy, familiar app
Tied to one phone; new phone means re-registering
Most office staff
Device-bound: Windows Hello / Entra passkey on Windows
The PC’s TPM
Fast daily sign-in on that machine
Only on that one device
Primary laptops
Synced
A platform passkey provider that syncs across a user’s devices
Survives phone replacement, easiest for users
Lower assurance; key leaves your control
Lower-risk roles, where you decide it is acceptable
You don’t have to pick one for everyone. That is what passkey profiles are for.
Phase 1: Prepare the tenant
Migrate to the Authentication methods policy if you haven’t already. Legacy per-method settings in the old MFA and SSPR pages can no longer be managed there, and passkeys are controlled only in the new policy.
Turn on passkey profiles. Go to Entra ID > Authentication methods > Policies > Passkey (FIDO2) and follow the banner to opt in. Your existing settings move into a Default passkey profile. At the time of writing, up to three profiles are supported including the default.
Design your profiles. A typical small business setup:
Admins and executives: device-bound only, attestation enforced, security keys and Authenticator allowed.
All staff: device-bound, Microsoft Authenticator and Windows Hello allowed.
Optional: a profile allowing synced passkeys for roles where you have decided the convenience is worth it.
Enable Temporary Access Pass so users who can’t satisfy MFA, or new hires, can bootstrap a passkey. A user has to have completed MFA within the last five minutes to register a passkey, and a TAP satisfies that.
Check app versions. If a profile allows both device-bound and synced passkeys and targets Authenticator, users need a recent Authenticator release on iOS and Android. Push updates through Intune before you start.
Phase 2: Admins and IT first
Start with the people who hold the keys to the tenant. Give every admin two hardware security keys (one daily, one backup) and register both. Register passkeys on the emergency access accounts too, and store those keys separately.
Then build a Conditional Access policy in report-only that requires the built-in Phishing-resistant MFA authentication strength for all directory admin roles. After a week with no unexpected failures, turn it on. From this point a stolen admin password plus a phished push approval no longer gets an attacker anywhere.
Phase 3: Pilot with a friendly group
Pick 10 to 20 people across departments, including at least one person who travels and one who is not comfortable with technology. Their job is to find the friction before everyone else does.
Send a short guide: open mysignins.microsoft.com/security-info, choose Add sign-in method, choose Passkey, follow the prompts on the phone or key.
Ask them to sign in to Outlook, Teams and the browser on each device they use, for a full week.
Track what broke: older apps that don’t support passkeys, kiosk PCs, personal devices.
Write down how long registration took. Most people finish in under five minutes; the outliers tell you where the guide needs work.
Phase 4: Roll out to everyone
Move in waves of one department at a time. For each wave:
Announce the change a week ahead, with the guide and a short video or screenshots.
Run a 30-minute drop-in session where people can register with help.
Add the department to the passkey profile target group.
Check the Authentication methods activity report to see who has registered.
Follow up individually with anyone who hasn’t registered after a week.
Keep Microsoft Authenticator push with number matching enabled as a fallback during the rollout. Removing older methods comes last.
We run these campaigns for clients as part of our MFA enablement service, and device-side setup such as Windows Hello and Authenticator deployment is handled through Intune.
Phase 5: Enforce and tighten
Once registration is high, raise the bar:
Require phishing-resistant MFA for sensitive apps first, such as finance systems, HR and anything with client data, using authentication strength in Conditional Access.
Extend the requirement to all users and all resources when the numbers support it, after a report-only week.
Disable SMS and voice for users who have a passkey. Keep a small, named group for genuine exceptions.
Protect security info registration with Conditional Access so attackers can’t add their own methods.
Lost or replaced phone. Issue a Temporary Access Pass, have the user register a new passkey, then delete the old one from their authentication methods.
Shared or kiosk PCs. Use hardware security keys, since Windows Hello is per user per device.
Staff without company phones. Security keys, or Windows Hello on their work laptop. Some organizations accept Authenticator on personal phones; make that a written decision.
Older apps. Anything that still asks for a password directly needs to be modernized or put behind a modern sign-in flow.
How to measure progress
Pick three numbers and track them weekly during the rollout: the share of users with at least one passkey registered, the share of sign-ins completed with a phishing-resistant method, and the number of helpdesk tickets tagged as sign-in problems. The first two come from the authentication methods reports in the Entra admin center. When registration passes roughly nine in ten users and tickets have settled, you are ready for Phase 5. If tickets spike, pause the next wave and fix the guide before moving on.
Frequently asked questions
Do passkeys in Microsoft Entra ID need an extra license?
No. Passkeys (FIDO2) are available in all Entra ID editions, including Free. Enforcing them with Conditional Access authentication strengths does need Entra ID P1, which is in Microsoft 365 Business Premium, E3 and E5.
Should we allow synced passkeys?
Synced passkeys are still phishing resistant and much easier to live with, but the key is copied to a provider outside your control. For admins and high-risk roles, stick with device-bound keys and enforce attestation. For general staff, it is a reasonable choice if you document it.
What happens if a user loses their only passkey?
An admin or helpdesk issues a Temporary Access Pass, the user signs in with it and registers a new passkey, and the lost one is removed. That is why every user should ideally have two methods, and admins two keys.
Ready to move past passwords? Start with a free Microsoft 365 security assessment. We’ll check your authentication methods, admin protection and Conditional Access, then lay out a passkey rollout that fits your team.
Passwords plus a push notification stopped being enough once attackers started running phishing kits that relay MFA in real time. Passkeys in Microsoft Entra ID fix that problem at the root, because the credential is bound to the real Microsoft sign-in page and simply won’t work on a fake one. The good news for smaller organizations: passkeys are available in every Entra ID edition, including Free, with no extra license.
This is the phased plan I use to move a 20 to 500 person organization from passwords and push notifications to passkeys, without a flood of helpdesk tickets.
Passkey types in plain English
A passkey is a FIDO2 credential: a private key stored on a device, unlocked with a PIN or biometric, that signs a challenge from Microsoft Entra ID. The site never sees a shared secret, and the key only works for the real domain. Entra ID supports two broad kinds:
You don’t have to pick one for everyone. That is what passkey profiles are for.
Phase 1: Prepare the tenant
Entra ID > Authentication methods > Policies > Passkey (FIDO2)and follow the banner to opt in. Your existing settings move into a Default passkey profile. At the time of writing, up to three profiles are supported including the default.Phase 2: Admins and IT first
Start with the people who hold the keys to the tenant. Give every admin two hardware security keys (one daily, one backup) and register both. Register passkeys on the emergency access accounts too, and store those keys separately.
Then build a Conditional Access policy in report-only that requires the built-in Phishing-resistant MFA authentication strength for all directory admin roles. After a week with no unexpected failures, turn it on. From this point a stolen admin password plus a phished push approval no longer gets an attacker anywhere.
Phase 3: Pilot with a friendly group
Pick 10 to 20 people across departments, including at least one person who travels and one who is not comfortable with technology. Their job is to find the friction before everyone else does.
mysignins.microsoft.com/security-info, choose Add sign-in method, choose Passkey, follow the prompts on the phone or key.Phase 4: Roll out to everyone
Move in waves of one department at a time. For each wave:
Keep Microsoft Authenticator push with number matching enabled as a fallback during the rollout. Removing older methods comes last.
We run these campaigns for clients as part of our MFA enablement service, and device-side setup such as Windows Hello and Authenticator deployment is handled through Intune.
Phase 5: Enforce and tighten
Once registration is high, raise the bar:
For the configuration details, Microsoft’s guide on enabling passkeys (FIDO2) in Microsoft Entra ID is the authoritative reference.
Handling the awkward cases
How to measure progress
Pick three numbers and track them weekly during the rollout: the share of users with at least one passkey registered, the share of sign-ins completed with a phishing-resistant method, and the number of helpdesk tickets tagged as sign-in problems. The first two come from the authentication methods reports in the Entra admin center. When registration passes roughly nine in ten users and tickets have settled, you are ready for Phase 5. If tickets spike, pause the next wave and fix the guide before moving on.
Frequently asked questions
Do passkeys in Microsoft Entra ID need an extra license?
No. Passkeys (FIDO2) are available in all Entra ID editions, including Free. Enforcing them with Conditional Access authentication strengths does need Entra ID P1, which is in Microsoft 365 Business Premium, E3 and E5.
Should we allow synced passkeys?
Synced passkeys are still phishing resistant and much easier to live with, but the key is copied to a provider outside your control. For admins and high-risk roles, stick with device-bound keys and enforce attestation. For general staff, it is a reasonable choice if you document it.
What happens if a user loses their only passkey?
An admin or helpdesk issues a Temporary Access Pass, the user signs in with it and registers a new passkey, and the lost one is removed. That is why every user should ideally have two methods, and admins two keys.
Ready to move past passwords? Start with a free Microsoft 365 security assessment. We’ll check your authentication methods, admin protection and Conditional Access, then lay out a passkey rollout that fits your team.