Passkeys in Business: How to Say Goodbye to Passwords Forever and Boost Security

Tired of constant resets for forgotten passwords, user complaints about complex requirements, and the persistent fear of phishing attacks? You are not alone. Password management has become one of the biggest security and operational pain points for Slovenian companies, regardless of size. However, a solution is coming that promises the end of this era. Implementing passkeys in the enterprise is no longer science fiction but a practical and necessary step towards a more secure and efficient digital future. This technology fundamentally changes how users log in to business systems and applications.

In this article, we will look at exactly what passkeys are, why they are significantly better than any password, and most importantly – how you can strategically and safely introduce them into your business environment. We will focus on practical steps that Slovenian small and medium-sized enterprises can take, with concrete use cases in tools like Microsoft Entra ID.

What are 'passkeys' and why are they better than passwords?

A passkey is a modern login standard that replaces passwords. Instead of the user inventing (and trying to remember) a complex combination of characters, a passkey creates a unique cryptographic key pair: a public and a private one.

• The public key is stored on the application or service server (e.g., Microsoft 365, Google Workspace). This key by itself is useless for logging in and is not sensitive data.
• The private key remains securely stored on the user's device – phone, laptop, or a specialized security key (such as a YubiKey). This key never leaves the device.

When a user wants to log in, the server sends a "challenge" that only the corresponding private key can solve. The user simply confirms the login with biometrics (fingerprint, face recognition) or by entering their device PIN. The device then digitally signs the challenge and sends it back to the server, which verifies the signature with the public key. All this happens in seconds, without entering a password.

The key advantage is that passkeys are inherently resistant to phishing attacks. Since there is no password for the user to enter on a fake website, attackers cannot steal it. Furthermore, each passkey is bound to a specific web domain, preventing its misuse on other sites.VitalIT Security Expert

Comparison: Traditional Passwords vs. Passkeys

To help you understand the extent of improvements that passkeys bring to the business, let's look at a direct comparison of key security and usability aspects.

Planning the deployment of passkeys in the enterprise: Practical steps

Transitioning to a passwordless future requires a strategic approach. A blind leap into the unknown can cause confusion among employees and create security holes. We recommend a gradual rollout in four phases.

Phase 1: Analysis and Planning

Before technical implementation, it is crucial to understand the current state and set clear goals.

1. Application Inventory: Identify key business applications (inside and outside the Microsoft 365 ecosystem). Which of them already support the FIDO2 standard or passkey login? For which will you need to maintain existing login methods?
2. User and Device Assessment: Do all employees have work smartphones (iOS, Android)? What is the policy regarding the use of personal devices (BYOD)? Are there workstations (e.g., in production, warehouse) where shared computers are used?
3. Defining a Pilot Group: Choose a smaller, more technically savvy group of users (e.g., IT department, developers) to test the implementation process, gather feedback, and resolve potential issues.
4. Setting the Policy: Define the rules of use. Will you allow storing passkeys on personal devices? Will you require the use of dedicated FIDO2 security keys (e.g., YubiKey) for certain roles? What is the procedure in case of device loss?

Phase 2: Technical Implementation (Example: Microsoft Entra Passkey)

If your company uses Microsoft 365, Microsoft Entra ID (formerly Azure Active Directory) is your central hub for identity management. Enabling passkeys is a relatively simple process.

• Enabling Authentication Methods: In the Microsoft Entra admin center under "Protection" > "Authentication methods", enable the "FIDO2 security key" method.
• Policy Configuration: Determine which users or groups the policy applies to. Initially, limit it to your pilot group.
• Settings for Passkeys: Entra ID allows advanced settings, such as "attestation enforcement", which lets you restrict use to only specific, verified security key models.
• User Registration: Users must register their own devices or security keys. They do this on the myaccount.microsoft.com page under security information. The process is simple and guided.

Ensure comprehensive cybersecurityImplementing passkeys is an important part of a modern security strategy. Our team can help you plan and implement comprehensive security solutions tailored to your business.

Phase 3: Communication and Employee Training

Technology is only half the story. The success of the rollout depends on how employees accept it. Do not underestimate the power of good communication.

• Explain the "Why": Present the benefits to employees – easier and faster login, no more need to remember passwords.
• Prepare Clear Instructions: Create short, visual guides (PDF, video) for the passkey registration process on different devices (Windows Hello computer, smartphone).
• Organize Workshops: For the pilot group and later for all employees, organize short live or remote presentations where you demonstrate the process and answer questions.
• Emphasize Recovery Procedures: Clearly communicate what employees should do if they lose their phone or if their laptop breaks down. This reduces fear of the new technology.

Phase 4: Monitoring, Support, and Expansion

After successfully completing the pilot phase, it is time to expand to the entire company. Monitor login reports in Microsoft Entra ID to see how many users are actually using passwordless login. Be ready to provide support to users who encounter issues and gradually expand the passkey policy to all employees and, where possible, to all applications.

The future is passwordless: FIDO2 and the wider ecosystem

It is important to understand that passkeys are not an Apple, Google, or Microsoft invention. They are the result of the work of the FIDO Alliance (Fast Identity Online), an industry association whose goal is to create open and interoperable standards for authentication. This means that a passkey created on an iPhone will work for logging in to a Windows computer and vice versa (via Bluetooth or a QR code). This interoperability is key to the long-term success of the passwordless concept.

Support for the technology is growing every day. In addition to operating systems, more and more websites and applications are integrating it into their services, from social network providers to banking platforms. By implementing passkeys in the enterprise, you are not just solving a current password problem, but positioning your company on the right side of technological development and preparing it for the future.

What happens if an employee loses a device with a passkey (e.g., a phone)?

This is not a security disaster. First, the device is protected by a PIN or biometrics. Second, an IT administrator can revoke the passkey for that device in the system (e.g., Microsoft Entra ID). The user can use another registered passkey (e.g., on a laptop or security key) for access, or IT can grant them a Temporary Access Pass (TAP) so they can register a new device.

Are passkeys secure if someone steals my phone and knows my PIN?

Device PIN codes are a weak point of any system. Therefore, it is recommended to use biometrics (fingerprint, face) wherever possible. In business environments, IT departments can use mobile device management (MDM) tools to enforce policies for PIN code complexity and automatic device lock/wipe in case of multiple incorrect attempts.

Do I need to create a new passkey for every service?

Yes, and that is an advantage. Each passkey is unique to the combination of the user account and the website/application. Due to synchronization (e.g., via iCloud Keychain, Google Password Manager, or Microsoft account), you do not have to deal with each one individually. Once you create a passkey on one device, it automatically becomes available on your other devices within the same ecosystem.

Do we need to abandon all passwords and MFA apps immediately?

No. The transition will be gradual. Passwords will still exist for a while as a backup method and for accessing older applications that do not support passkeys. A good strategy is to first enable passkeys as the primary and easiest login method, while keeping existing methods as backups.

What is the difference between a passkey on a phone and a FIDO2 security key (e.g., YubiKey)?

Functionally, they are very similar as both are based on the FIDO2 standard. A passkey on a phone or computer ("platform authenticator") uses the device's built-in security hardware. A physical security key ("roaming authenticator") is a separate, dedicated device that can be carried between computers and is often more resistant to misuse. For users with the highest security requirements (e.g., system administrators, management), the use of physical FIDO2 keys is highly recommended.