What is a Microsoft passkey, and why is Microsoft asking my staff to set one up?

A plain answer for a small firm that has just seen the prompt. Facts are from Microsoft's own pages, read October 28, 2026.

Updated 2026-10-28

Short answer. A passkey is a sign-in credential. Microsoft's passkey page says passkeys replace "phishable methods like passwords, SMS, and email codes": a private key "is stored on your device", the public key "is stored with the app or the website that you sign into", and the person unlocks it on the device, for example with "face, fingerprint or PIN". The prompt goes with Microsoft's retirement of its own texted and phoned sign-in codes: February 1, 2027 for most users, July 1, 2027 for Global Administrators and external users. We can't see your tenant, so we can't say whose sign-in this touches.

Where a passkey is kept

The passkey page names two kinds. A device-bound passkey's private key is "created and stored on a single physical device and never leaves it"; a synced one is kept by a cloud passkey provider. Four places staff may hold one:

Microsoft Authenticator on a phone (device-bound). Microsoft's Authenticator page says the phone "needs to run iOS version 17 or later" or "Android version 14 or later".
A Windows PC (device-bound; Microsoft calls it Microsoft Entra passkey on Windows). The deployment guide says people "will authenticate with Windows Hello (face, fingerprint, or PIN)" and that "each device requires separate registration per Microsoft Entra account".
A FIDO2 security key (device-bound), a physical key. The passkey page says keys "can increase costs for equipment, training, and helpdesk support".
iCloud Keychain or Google Password Manager (synced). The retirement page describes these as "synced across the user's devices".

Why the prompt is appearing

The retirement page says Microsoft Entra ID "is making passkeys the default sign-in experience"; its FAQ says "The primary driver is security". Starting September 1, 2026, users enabled for SMS or voice are enabled for passkeys automatically, and when they next sign in and complete MFA they are nudged to register one. By default, "users will have unlimited snoozes of the nudge prompt". After February 1, 2027, users in scope whose "only available MFA method is SMS or voice" get a blocking prompt: can staff skip it? has the details. Users already on passkeys, Windows Hello for Business or another phishing-resistant method "can continue using those methods".

What changes for staff

At sign-in, the passkey page's steps have the person pick a passkey (on this device, across devices by QR code, or a security key) and make a "biometric or PIN gesture" to unlock it.
Setup is done in a browser at Security info. Microsoft's passkey setup page says the person must have completed MFA "within the past five minutes", so plan it as one sitting. The guide page lists Microsoft's steps.
The deployment guide recommends "at least two authentication methods registered", so there is a backup after "device loss or theft".

What the firm has to decide

Which kinds of passkey to allow. The retirement page says users enabled for SMS or voice "will be put into a passkey profile allowing all types of passkeys". The passkey page says "synced passkeys offer a convenient, low-cost alternative to traditional MFA" for most users, and that security keys are recommended for "highly regulated industries or users with elevated privileges". An administrator sets the allowed types in a passkey profile.
Whether anyone needs texted codes to carry on. Microsoft's route is a telephony provider through Microsoft Security Store. The FAQ says "Pricing varies by telephony provider and region" and "The configuration experience becomes available beginning October 30, 2026". It also says migrating Microsoft-provided SMS and voice users to passkeys "incur no additional cost".
When and how to tell staff. The retirement page recommends a phased plan: "Awareness", "Action", then "Reminder".

Snags at a small firm

One computer or login used by several people: shared front-desk logins and computers.
Staff without a smartphone: what Microsoft's pages offer instead.
Older phones and PCs: the deployment guide says "Older operating systems may require external authenticators, like FIDO2 security keys".
Guests: the passkey setup page says registration "isn't supported for internal or external guest users".

Next step

Passkey Switch writes the switch plan for your firm by email: US$249, nothing added, one time. We never log in to your tenant or take passwords or codes. Full refund on request within 14 days of purchase if the work has not been delivered, or if you tell us it did not meet the offer (terms). This is IT how-to writing, not legal or compliance advice.

Order by email See the pack and what it costs

Sources, all Microsoft Learn and all read October 28, 2026: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication, dated 2026-09-23, and its FAQ, dated 2026-10-20; Passkeys (FIDO2) authentication method, 2026-02-02; How to enable passkeys (FIDO2), 2026-03-08; Register passkeys in Authenticator on Android and iOS devices, 2026-07-05; Plan a phishing-resistant passwordless authentication deployment, 2026-03-26. Passkey Switch is not affiliated with Microsoft, which can change its dates and steps; check its pages before you act. Written by Ellis, an AI assistant.