Passwords and Passkeys for a Small Team: A Practical Guide

The password is still the main way to protect business accounts, yet it is often the weak link. Employees reuse passwords, write them on paper, or enter them on a fake page. In this article we look at two additional tools: a password manager and a passkey. We will see how this looks in Microsoft 365 and Google Workspace and how to start step by step.

What a passkey is

A passkey is an alternative to a password. It works on a pair of keys, one public and one private. In Microsoft's system, Entra ID stores the public key, while the private key stays on your device. When signing in, you no longer type a password. You unlock the account with a fingerprint, your face, or the screen PIN of your phone or computer. Google explains that the screen lock only unlocks the passkey locally and does not share biometric data with Google or other parties.

The main advantage is protection against phishing. A user can be tricked into typing a password on a fake page, but a passkey has no secret that a fraudster could obtain. The US cybersecurity agency CISA notes in its recommendations that hardware FIDO security keys are the most effective, while passkeys are an acceptable alternative.

A password manager is still needed

Not every service supports passkeys yet. So passwords will remain in many places: bank portals, supplier pages, old programs and other services. This is where a password manager helps. CISA advises storing all passwords in a manager. Some managers warn us if a password is weak, repeated or leaked. According to CISA, the manager's master password should be a long, unique and random phrase. It is better to replace existing weak passwords with ones created by the manager.

A simple rule: where a passkey exists, use it. Everywhere else, each account should have its own generated password, stored by the manager.

Microsoft 365: passkey in Microsoft Entra ID

Microsoft Entra ID supports passkeys as an authentication method. According to the Microsoft Learn documentation, it currently works with FIDO2 security keys and with passkeys stored in Microsoft Authenticator. A few practical details we need to know:

• Authenticator passkeys are protected by hardware. On iOS the private key is stored in the Secure Enclave.
• On Android, Authenticator stores a passkey only if the device has the appropriate secure hardware. Otherwise the registration cannot be completed.
• In Authenticator, we can have only one passkey per account.
• To sign in from another device, Bluetooth and internet must be turned on on both devices.
• On Android, Authenticator uses the capabilities of Android 14 or a newer version. So older phones may not work.

The administrator turns this method on in the Microsoft Entra admin center. The path is: Protection, then Authentication methods, then Passkey (FIDO2). There you can also enable self-registration, so that users can add passkeys from their own security page. First assign the method to a group, for example the administrators and a few volunteers. It is better to roll it out to the whole team only after testing.

Google Workspace: passkey and the Google account

In Google Workspace, the administrator can allow skipping the password with a passkey. This setting is off by default. To turn it on, go to the Security section in the Admin console, to the Passwordless item. Even when skipping the password is turned off, a user can still create a passkey, but only as a 2-step verification method.

After this, users can create a passkey in their account settings. According to Google's help page, three things are useful:

• The operating system and browser must be up to date for the passkey to work properly.
• A passkey should not be created on a shared device, so that other users cannot access the account.
• Signing in to a Workspace account with a passkey alone is possible only if the administrator has allowed it. The user will see this on the corresponding page of the account settings.

If an employee temporarily cannot use the second authentication method, they may be locked out of the account. For this case the administrator can generate backup verification codes. This should be thought through and planned in advance.

A step-by-step plan for a small team

1. First protect the most important accounts: those of administrators, email, file storage and remote access.
2. Choose a password manager that suits the team, and show every employee how to use it.
3. Finish rolling out 2-step sign-in for all users. We have already covered this in detail in our separate article.
4. Enable passkeys as a trial for the administrators and a few employees, and check which devices work.
5. Decide in advance what happens when a device is lost: who verifies identity, how access is restored, and how the passkey of the lost device is revoked.
6. Set a rule that passkeys are created only on personal work devices and not on shared computers.

Common mistakes

The first mistake is turning on passkeys for everything at once without testing the recovery path. The second mistake is neglecting to inform the team: employees should know in advance why the sign-in rule is changing, so that they do not take the new request for a fake message. The third mistake is ignoring device updates, because a passkey may not work on an old browser or operating system.

A passkey does not replace other protection. It goes well with phishing-recognition habits, up-to-date devices and backups.

If you need help planning these changes or configuring the security settings of Microsoft 365 and Google Workspace, Appy.ge is a Georgian IT company that can help you with these matters. Appy is an official Microsoft CSP partner and also works with Google Workspace.

Sources:
• Mobile Communications Best Practice Guidance (CISA) - https://www.cisa.gov/sites/default/files/2025-12/guidance-mobile-communications-best-practices_508c.pdf
• Passkey FAQs - Microsoft Entra ID (Microsoft Learn) - https://learn.microsoft.com/en-us/entra/identity/authentication/passkey-faq
• fido2 compatibility (Microsoft Learn) - https://learn.microsoft.com/en-us/entra/identity/authentication/fido2-compatibility
• Sign in with a passkey instead of a password - Google Account Help - https://support.google.com/accounts/answer/13548313?hl=en
• Simplify and strengthen sign-in by enabling passkeys for your users (Google Workspace Updates) - https://workspaceupdates.googleblog.com/2023/06/passkey-open-beta.html