Glossary
Passkey
Also called: FIDO2 credential, WebAuthn
In one sentence
A password replacement that signs you in with your device’s fingerprint, face or PIN, using cryptography that can’t be phished.
A passkey is a sign-in method built on the FIDO2 and WebAuthn standards, supported by Microsoft, Apple and Google. Instead of typing a password, you unlock your phone or computer with a fingerprint, face scan or PIN, and the device proves who you are using a cryptographic key pair. The private key never leaves your device; the website only ever holds the public half.
The headline benefit is that passkeys are phishing-resistant. Each passkey is tied to the real website’s address, so a fake Microsoft login page can’t use it — there’s nothing for staff to type in and nothing for an attacker to steal and replay. That defeats the most common way small-business accounts are taken over, including attacks that capture text-message codes.
Microsoft Entra ID supports passkeys, including passkeys stored in the Microsoft Authenticator app and physical security keys. Rolling them out takes planning: staff need a supported device, you need a recovery process for lost phones, and some older apps may still need a password for a while.
Example: a practice owner and office manager — the two accounts with the most access — switch to passkeys in Microsoft Authenticator. A convincing phishing email that later lands in the owner’s inbox leads to a fake sign-in page that simply can’t complete the login. Read our MFA guide to see where passkeys fit among the MFA options.
Related terms
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- PhishingPhishing is a scam message — usually an email, but also texts and phone calls — designed to trick someone into handing over a password, opening malware or sending money.
- Password managerAn encrypted app that creates, stores and fills in strong, unique passwords, so staff don’t have to remember or reuse them.
- Microsoft Entra IDMicrosoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service — the system that holds your users' accounts and controls how they sign in to Microsoft 365 and other apps.
- Conditional AccessConditional Access is the Microsoft Entra ID feature that decides, at every sign-in, whether to allow, block or require extra checks based on who is signing in, from what device, and from where.