Every month, your IT helpdesk fields password reset requests. Every year, the same breach reports list stolen credentials as the leading cause. The Verizon Data Breach Investigations Report has found, year after year, that more than 80% of data breaches involve compromised credentials.
There’s a way out of this that doesn’t require asking users to memorise anything new. Passkey migration moves a firm off shared-secret passwords and onto cryptographic credentials that live on the user’s device. The approach is already supported across Microsoft 365 and most major identity providers. For most professional services firms, the infrastructure is already in place.
What a passkey actually is
A passkey is a cryptographic credential, not a password. When you register with a service, your device generates a matched pair of digital keys. The private key stays on the device and never leaves it. The public key goes to the service.
When you sign in, your device proves you’re you using biometrics (Face ID, fingerprint, or Windows Hello) or a device PIN, then signs a cryptographic challenge from the server. The server checks the signature using the public key. No password is ever transmitted.
That has three consequences worth noting. A passkey can’t be phished, because a fraudulent login page can’t trigger authentication on the real device. It can’t be reused, because it’s bound to a specific domain. And it can’t be stolen in a server-side breach, because the private key never exists outside the device.
Passkeys are built on the FIDO2 and WebAuthn open standards, jointly backed by Apple, Google, and Microsoft. The FIDO Alliance reported in early 2026 that more than 15 billion online accounts now support passkey sign-in, double the figure from a year earlier.
Why this matters now
MFA helped close the password gap. SMS-based MFA, still the most common form, has a known weakness. Modern phishing kits can intercept a one-time code in real time: a fake login page captures both the password and the code, then replays them on the real site before the session expires.
Phishing-resistant MFA closes that gap by design. Passkeys make it technically impossible for a fraudulent page to trigger login on the real device, because the credential is cryptographically bound to the legitimate domain.
The standards bodies have started to formalise this. NIST’s 2025 update to SP 800-63-4 now requires phishing-resistant authentication as a mandatory option for high-assurance access. For firms in regulated work, passkey migration is becoming a compliance step as well as a security one.
What migration actually looks like
Passkey migration isn’t a single cutover. It’s a gradual transition that runs passwords and passkeys in parallel until passkeys are the default across the accounts that matter.
A migration plan covers three things: which platforms already support passkeys, which users to start with, and what fallback exists for tools not yet ready.
For firms running Microsoft 365, the support is already there. Microsoft enabled passkeys through Entra ID and made them the default sign-in for new accounts in May 2025. The same goes for Google Workspace, which has supported passkeys since 2023.
How to roll it out without disrupting the team
Three principles keep migration manageable.
- Start where support already exists.
Begin with administrators and partners who reset passwords most often and hold the highest-risk access. They’ll give the most useful feedback on friction before the change reaches the wider team. - Run passwords and passkeys in parallel.
The most common migration mistake is treating it as a hard cutover. Users can authenticate with a passkey on enrolled devices and fall back to a password on any device not yet enrolled. Running both gives time for adoption without locking anyone out mid-project. - Plan for platforms that aren’t ready yet.
Not every tool supports passkeys today. For those, a password manager generating unique credentials is the right bridge. It removes the reuse risk now, and when those tools add passkey support, migration becomes a single enrolment step rather than a behaviour change.
The case beyond security
Security is the headline benefit. The operational gains are also real. Google reports that passkey sign-ins are four times more successful than password-based logins, with sign-in speeds around 20% faster. Users no longer mistype passwords, wait for SMS codes, or get locked out trying an old credential. Fewer failed logins means fewer helpdesk calls and fewer interrupted billable hours.
The takeaway
Passwords aren’t going to disappear next quarter. But for a firm running Microsoft 365, the platform is ready, the standards are aligned, and the rollout doesn’t have to be disruptive.
If you’d like us to map out which platforms in your environment support passkeys today and build a plan, we’re happy to help.