What’s new
Why we’re recommending passkeys for Microsoft 365
You know the drill. Type your email, type your password, wait for a code, type that in too, and you’re finally in, three steps just to check your inbox. Multiply that by every device, every day, and it’s a small but constant drag on everyone’s morning.
It’s also, quietly, one of the weaker points in most businesses’ security. Passwords get reused across accounts, written down, or picked because they’re easy to remember rather than hard to guess. And even a properly set-up second step, a text message or an app code, can be talked around by someone convincing enough on the phone. That’s part of why only 47% of UK businesses consistently use multi-factor authentication at all (DSIT, Cyber Security Breaches Survey 2025/2026), the friction of doing it properly puts a surprising number of businesses off altogether.
Passkeys are the next step past that problem, not by adding another thing to remember, but by removing the password from the equation entirely.
How a passkey is actually different
A password is a secret you type in, which means it can be guessed, stolen, or typed into a fake login page without you realising it isn’t the real one. A passkey doesn’t work that way. It’s tied to your specific device and unlocked with your face, fingerprint, or PIN, the same way you already unlock your phone. There’s no secret being typed anywhere, which means there’s nothing for a fake website to steal, and nothing to accidentally hand over to someone pretending to be your IT provider on the phone.
What this actually fixes
Phishing stops working the way it used to. A passkey only works on the genuine Microsoft sign-in page it was created for. Even a very convincing fake login page can’t trick it into handing anything over, because there’s no password to type.
“MFA fatigue” attacks lose their power. Some attacks rely on bombarding someone with approval requests until they tap “yes” out of frustration or habit. Approving a passkey requires your actual face, fingerprint or PIN in the moment, not just a tap on a notification.
There’s nothing to reuse or write down. No password means no risk of the same one turning up reused on a personal account that gets breached somewhere else entirely.
Signing in gets faster, not slower. Type your email, tap “sign in with passkey,” approve with your fingerprint. Done. It’s a rare case where the more secure option is also the quicker one.
What doesn’t change
Your password still works as a backup if your phone isn’t with you, passkeys sit alongside it rather than replacing it overnight. Nobody gets locked out because a phone was left at home. It’s an additional, faster option that happens to close off some of the most common ways accounts get compromised, not a forced switch with no safety net.
Why now
None of this is a response to something having gone wrong. It’s the kind of change that’s much easier to make calmly, ahead of time, than to rush through after an account’s already been compromised. Microsoft has made the setup itself genuinely straightforward, on a phone it takes about five minutes, and it’s the kind of quiet improvement that pays for itself the first time it stops a phishing attempt nobody even noticed.
If you’d like help rolling passkeys out across your team, get in touch. We’ve already put together a step-by-step setup guide for existing Cactus IT customers, and we’re happy to talk through what it’d look like for your business. If you arent already a customer, we would welcome an opportunity for a chat.
Source: Department for Science, Innovation and Technology (DSIT), Cyber Security Breaches Survey 2025/2026, GOV.UK.