rabbit it
rabbit it

Passkeys Instead of Passwords: Is The Switch Worthwhile for SMEs?

MPasswords get forgotten, reused, stuck on Post-it notes – and above all, they can be phished. Even classic two-factor authentication with an SMS code offers only limited protection against modern phishing sites, because attackers simply intercept the code in real time. Passkeys solve exactly this problem. And for anyone working with Microsoft 365, the question is no longer “if” but “when”.


What a passkey is
A passkey replaces the password with a key pair. The secret part stays on your device – in your smartphone, your notebook or on a USB security key. It is unlocked with a fingerprint, facial recognition or a PIN. The service you sign in to only knows the public part.
The crucial point: a passkey is firmly bound to the genuine web address. If an employee lands on a convincing fake login page, the passkey simply does not work there. There is nothing they could accidentally type in or give away.


Microsoft is pushing ahead
Since 1 September 2026, passkeys have been the default method in Microsoft Entra ID – the sign-in behind Microsoft 365. Anyone who still confirms by SMS or phone call is prompted to register a passkey when signing in. On 1 February 2027, Microsoft will discontinue its own SMS and voice call confirmation entirely. By then, every person must have set up a phishing-resistant method.


The everyday benefits

  • Protection against phishing: The most common entry point for attackers largely disappears.
  • Faster sign-in: Touch a fingerprint sensor instead of typing a password and waiting for an SMS.
  • Less support: Forgotten or expired passwords are one of the most common reasons for support tickets.
  • No password reuse: A passkey is valid for one service only. A data breach at another provider does not affect you.


What to watch out for

  •  Choose the right type: Synced passkeys (e.g. in the iCloud or Google keychain) are convenient. Device-bound passkeys as for example in the Microsoft Authenticator app remain under your control.
  • Employees without a company phone: Not everyone wants to use their private smartphone. For them, a hardware key costing around 30 to 60 francs is the clean solution.
  • Loss and device changes: Define how someone regains access if their smartphone is gone – without that process itself becoming a security gap.
  • Shared accounts and legacy systems: Shared mailboxes, machine logins or older industry software need their own solution. Identify these cases early.

 

How to roll it out successfully
Start with a small pilot group, ideally including management and accounting – the accounts that are attacked most often. The rest of the workforce follows in stages, supported by a short guide. What matters is that the switch is completed before February 2027, so that nobody suddenly finds themselves locked out of their account.

Yes, the switch is necessary – even for a small team. Passkeys are more secure and more convenient than passwords, and Microsoft is setting the timetable anyway. If you plan the rollout now, you stay in control instead of having to catch up under time pressure in February.
Would you like to introduce passkeys in your company? We review your Microsoft 365 environment, plan the rollout and support your employees through the switch. We are here for you. Fast. Agile. Reliable.