In April 2026 the UK’s National Cyber Security Centre (NCSC) made a clear call: passkeys should now be people’s first choice of login. Its research found passkeys are “at least as secure as, and generally more secure than” the strongest password combined with two-step verification.
That’s a big shift, and it’s starting to reach business systems too. Here’s what passkeys are, why they matter for a small business, and how to start using them with Microsoft 365.
What is a passkey?
A passkey replaces your password with a pair of digital keys. One is stored securely on your device: your phone, your laptop or a small USB security key. The other is held by the website or service you sign in to. When you log in, the two keys prove they match, and you confirm it’s you with your fingerprint, face or device PIN.
There’s nothing to type, nothing to remember and nothing for anyone to steal from a database.
Why passkeys stop most phishing
Most attacks on small businesses don’t involve clever hacking. They start with an email that looks like a Microsoft login page, and someone typing their password into it. Modern phishing kits can even capture the one-time code from an authenticator app as it’s entered and use it straight away.
Passkeys don’t work that way. A passkey is tied to the genuine website it was created for, so a fake login page simply can’t use it. There’s no password to hand over and no code to intercept. That is why the NCSC rates passkeys above even a strong password with two-step verification.
What the NCSC actually said
- Passkeys should be the first choice of login wherever they’re available.
- Businesses should offer passkeys to their customers as the default way to sign in.
- Where a service doesn’t support passkeys yet, use a password manager to create strong, unique passwords, and keep two-step verification switched on.
- Account recovery matters too: a weak password reset process can undo the benefit of a strong login.
The NCSC’s April advice is aimed mainly at the services people sign in to, and it has said more guidance for organisations is on the way. But the reasons it gives apply just as much to your staff signing in to Microsoft 365.
Passkeys and Cyber Essentials
The latest version of Cyber Essentials, which applies to assessments opened since 27 April 2026, recognises passwordless sign-in with FIDO2 passkeys. The same update makes multi-factor authentication a hard requirement on every cloud service that offers it: if it’s available and switched off, the assessment fails.
So if you’re working towards certification or renewing it, passkeys are a strong way to meet the sign-in requirements for Microsoft 365.
Passkeys in Microsoft 365
Microsoft 365 sign-ins are handled by Microsoft Entra ID, and it already supports passkeys. According to Microsoft’s documentation, passkeys are available in every edition of Entra ID, including the free one, with no extra licences needed. There are three main options:
- Passkeys in the Microsoft Authenticator app on your phone. The passkey stays on that phone.
- Security keys, small USB or NFC keys that you plug in or tap. A good choice for administrator accounts and shared desks.
- Synced passkeys stored in Apple Passwords, Google Password Manager or a password manager such as 1Password or Bitwarden, so they’re available across your devices.
This year Microsoft has also introduced “passkey profiles”, which let you set different rules for different groups of people: for example, security keys only for administrators, and synced passkeys allowed for everyone else. The change has been rolling out through 2026.
Where to start
- Make sure multi-factor authentication is on everywhere. That means Microsoft 365, plus your accounting, CRM, file-sharing and other cloud apps. It’s the foundation, and it’s now essential for Cyber Essentials.
- Start with the accounts that matter most. Give administrators, directors and finance staff passkeys first. They’re the accounts attackers want.
- Sort out account recovery. Decide how someone gets back in if they lose their phone, and make sure that process can’t be talked around by a convincing phone call.
- Roll out to everyone else. For most staff, passkeys in Microsoft Authenticator or a synced passkey work well, and sign-in becomes quicker than typing a password.
- Turn on passkeys elsewhere. Many services your team already uses offer passkeys in their security settings. For the ones that don’t, use a password manager.
- Tell your team what’s changing. A two-minute explanation stops confusion and helpdesk calls.
How we can help
If we look after your IT, we can plan and roll out passkeys across your Microsoft 365 users, starting with your most sensitive accounts, and make sure your recovery process is sound. If you’re not a client yet and want to know where your business stands, book a call or ring us on 02920 022100.