Passwords have been part of our working lives for years. We use them to access emails, documents, business systems and just about everything else online.
Most of us have also become familiar with the extra security step that follows, usually a code sent to our phone to prove we’re the person signing in.
But Microsoft is changing how this works, with a move towards something called passkeys.
It’s a welcome change that should make signing in easier for employees while helping businesses protect their information.
So, what exactly is a passkey?
Despite the name, a passkey isn’t another password you need to remember.
It’s a more secure way to sign in using something you’re probably already familiar with, such as your fingerprint, facial recognition or the PIN you use to unlock your device.
If you unlock your phone using your face or fingerprint, you already know how straightforward the experience can be.
The clever part happens behind the scenes. Passkeys allow you to prove your identity without sending a traditional password, and they’re designed to work only with the genuine website or service you’re accessing.
For employees, that can mean fewer passwords to remember and fewer security codes to deal with.
Why is Microsoft making the change?
Passwords remain a common target for cyber criminals. They can be stolen, guessed or entered into convincing fake websites.
Adding an extra security step, known as multi-factor authentication (MFA), has helped, but text message verification isn’t without its weaknesses.
Criminals can trick people into sharing security codes, and text messages aren’t always reliable, particularly when someone has poor mobile reception.
Passkeys help address these problems. Because they’re linked to the genuine service, they’re much harder to exploit through phishing, where someone is tricked into visiting a fake website.
Microsoft is now encouraging organisations to adopt passkeys and is gradually retiring its own text message and telephone verification methods for Microsoft Entra ID, the system used by many businesses to manage access to Microsoft 365.
The change is being introduced in stages, with key deadlines during 2027. It doesn’t mean every password or text message will disappear overnight.
What are the benefits for your business?
The most obvious benefit is stronger security.
A stolen password or successfully intercepted verification code can give a criminal access to business emails and sensitive information. Passkeys significantly reduce the risk of these types of attacks.
There’s also a practical benefit for employees.
Anyone who’s waited for a security code that never arrives, or had to reset a forgotten password, will appreciate a simpler way to sign in.
For businesses with staff working remotely, travelling between sites or accessing systems throughout the day, removing unnecessary login frustrations can make everyday working a little easier.
And fewer password and login problems could mean fewer interruptions and less time spent asking IT for help.
For organisations handling confidential information, including professional services firms and care providers, improving the security of employee accounts is particularly important.
Does your business need to do anything?
If you use Microsoft 365, it’s worth reviewing how your employees currently sign in.
Some may already be using secure methods such as Windows Hello, while others still depend on text messages to verify their identity.
You’ll also want to consider employees who use shared computers, work across multiple locations or don’t have access to a suitable mobile device.
There’s no need for everyone to change how they work immediately, but understanding your current setup will help you prepare for Microsoft’s changes and avoid unnecessary disruption.
Making the move to safer sign-ins
Cyber security often comes with additional steps that can frustrate employees. Passkeys are a positive development because they offer stronger protection while potentially making everyday access to systems quicker and easier.
Microsoft’s changes are a useful reminder that it’s worth reviewing how your business manages access to its information and applications.
If you’re unsure how the move to passkeys will affect your organisation, get in touch with PS Tech. We can help you understand what the changes mean for your business and what steps may be needed to prepare.
Frequently Asked Questions About Passkeys
Will I still need a password to access Microsoft 365?
Not necessarily. Once passkeys are set up, you may be able to sign in using your fingerprint, facial recognition or device PIN instead of a traditional password. Some systems may still require passwords, depending on how your organisation is set up.
Are passkeys safer than passwords?
Yes. Passkeys offer much stronger protection against phishing because they only work with the genuine website or service they’re created for. This makes it significantly harder for criminals to steal your login details through fake websites.
What happens if I lose my phone or laptop?
Losing a device doesn’t automatically mean someone can access your accounts. Passkeys are protected by your device’s security features, such as a PIN or fingerprint. Your IT provider can help you regain access and set up a replacement passkey if needed.
Do employees need a mobile phone to use passkeys?
No. Passkeys can also be used on compatible laptops and computers, including Windows devices that support Windows Hello. The right approach will depend on your organisation’s equipment and how employees work.
When will Microsoft stop using text message verification?
Microsoft plans to retire its own SMS and telephone verification service for most Microsoft Entra ID users on 1 February 2027, with certain accounts following on 1 July 2027. Businesses that currently rely on these methods should review their arrangements ahead of the deadlines. Alternative verification options will remain available.
