UK business identity guide — checked 7 October 2026: This research-led article uses current NCSC passkey and MFA guidance plus current Microsoft Entra documentation. It explains authentication choices rather than claiming hands-on security testing of identity platforms.
Quick answer
Use passkeys where your business-critical services support them. The NCSC now recommends passkeys over passwords where available because FIDO2 credentials are phishing-resistant and can themselves satisfy multi-factor requirements when combined with local device verification such as a PIN or biometrics. Where passkeys are not available, use a strong unique password plus MFA. Avoid treating SMS codes as the final destination for high-value accounts when stronger options are available.
At a glance
| Method | Best use | Strength | Main limitation |
|---|---|---|---|
| Password only | Legacy fallback only | Universally supported | Phishable and reusable |
| Password + MFA | Services without passkeys | Much stronger than password alone | Strength depends on MFA method |
| Passkey / FIDO2 | Preferred modern sign-in | Phishing-resistant, no reusable password | Deployment/recovery planning still required |
| FIDO2 security key | Privileged/high-risk users | Device-bound phishing resistance | Key distribution and spare/recovery process |
What is a passkey?
A passkey is a FIDO2 credential that uses public-key cryptography. The service stores a public key while the private key remains protected by the user’s device or credential provider. The credential is bound to the legitimate website or application, which is why it is resistant to the common phishing trick of entering credentials into a convincing fake login page.
Users normally approve sign-in using the same mechanism that unlocks the device, such as a fingerprint, face scan or PIN. They do not type a reusable secret into the website.
Why passkeys are stronger against phishing
Passwords, SMS codes and one-time codes can be stolen or relayed by a convincing fake login page. Passkeys are origin-bound: the credential is created for the legitimate service and is not simply copied into an attacker’s site. The NCSC’s 2026 guidance says passkeys and other FIDO2 credentials are as secure or more secure than traditional MFA in realistic use and recommends enabling them for business-critical accounts where supported.
Does a passkey replace MFA?
It can. A passkey can provide more than one authentication factor when possession of the device is combined with local user verification such as biometrics or a PIN. Microsoft Entra, for example, treats FIDO2 passkeys as phishing-resistant authentication and supports them as a passwordless sign-in method.
Do not assume every consumer implementation, synced credential or enterprise policy behaves identically. Businesses with strict device-control requirements may prefer device-bound passkeys or hardware security keys, while synced passkeys can offer easier recovery and cross-device use.
Passwords still matter during the transition
Many services still retain a password even after a passkey is added. If a password fallback remains enabled, it must still be strong and unique and should still be protected by MFA. Otherwise the weaker fallback can undermine the stronger sign-in method.
A business password manager remains valuable during this transition. It can generate and store unique passwords for services that do not yet support passkeys and can also help teams manage shared credentials more safely. See our Best Business Password Manager UK guide.
Not all MFA is equal
The NCSC’s recommended order for corporate MFA puts FIDO2 credentials first, followed by challenge-based authenticator apps, app-based code generators, hardware code generators and then message-based methods such as SMS, email or calls. Any MFA is generally preferable to password-only authentication, but higher-value and administrator accounts should use stronger, phishing-resistant methods where possible.
Beware MFA fatigue and push approval attacks
Traditional push-based MFA can be abused when attackers bombard a user with approval requests until one is accepted. Challenge-based or number-matching methods reduce this risk, but passkeys/FIDO2 avoid the shared-secret phishing problem more fundamentally.
Business rollout plan
- Inventory critical services. Start with email, identity provider, finance, payroll, cloud storage, remote access and administrator portals.
- Check passkey/FIDO2 support. Enable it first for the accounts whose compromise would hurt most.
- Protect administrators first. Privileged users should receive the strongest authentication the platform supports.
- Plan recovery. Define spare keys, backup passkeys, recovery contacts and device-loss procedures before removing passwords.
- Keep MFA on weaker fallbacks. Do not leave an old password-only route available after deploying a stronger sign-in method.
- Train staff. Explain that legitimate passkey sign-in should not require typing a passkey or one-time code into a random web page.
- Monitor adoption. Track who has registered strong authentication and remove obsolete methods when the business is ready.
Passkeys in Microsoft 365 / Entra
Microsoft supports FIDO2 passkeys in Entra ID and has been moving toward passkeys as a default phishing-resistant authentication method. Businesses using Microsoft 365 should review current Entra authentication-method policies, Conditional Access requirements and recovery processes before a broad rollout.
What about SMS MFA?
SMS MFA is still better than relying on a password alone in many situations, but it is weaker than phishing-resistant FIDO2 methods. Use it as a transitional or fallback method when stronger options are not practical, rather than assuming all MFA provides the same protection.
Recovery is part of authentication security
A strong sign-in system can still fail if account recovery is weak. Document what happens when an employee loses a phone, leaves the company, loses a hardware key or cannot access a synced passkey. Recovery should verify the user strongly without creating a help-desk shortcut that attackers can socially engineer.
How we researched this guide
We used the NCSC’s 2026 small-organisation account-security guidance, its corporate MFA recommendations and its passkey security analysis, plus current Microsoft Entra FIDO2/passkey documentation. The guidance consistently favours phishing-resistant FIDO2 methods where practical while retaining strong passwords and MFA for services that have not yet moved to passkeys.
Primary sources
- NCSC: Passkeys — what you need to know
- NCSC: Secure your important online accounts
- NCSC: Recommended types of MFA
- Microsoft Entra: passkeys/FIDO2
Frequently asked questions
Are passkeys safer than passwords plus SMS?
Generally yes. Passkeys are designed to resist phishing and do not expose a reusable password or SMS code that can be entered into a fake site.
Should we remove every password immediately?
No. Move deliberately. Check service support, device compatibility, recovery and administrator workflows first. Where a password remains as fallback, keep it unique and protect it with MFA.
Do employees need hardware security keys?
Not necessarily. Platform passkeys on managed devices may be suitable for many users. Hardware FIDO2 keys are especially useful for administrators, high-risk staff, shared-device scenarios and environments that require device-bound credentials.
Final verdict
For a modern business, the direction is clear: use passkeys/FIDO2 where available, keep strong MFA on services that still depend on passwords, and treat recovery and legacy fallbacks as part of the security design. The goal is not simply “more login steps”; it is authentication that is harder to phish and easier for legitimate staff to use correctly.
