How to Set Up Passkeys for Your Small Business Team in 2026

To set up passkeys for a small business team, turn on passkey sign-in in your admin console, test it with a small pilot group, then require it for admins first. In Microsoft Entra it is a policy under Authentication methods. In Google Workspace it is a Security setting. Keep a recovery method ready for each person.

This guide is for owners and office managers who run their own Microsoft 365 or Google Workspace accounts. Little iApps writes step-by-step guides for setting software up, and this one walks through the admin settings, a pilot plan and the recovery rules that stop a lost phone from locking someone out.

What Is a Passkey, and Why Should a Small Business Care?

A passkey is a sign-in credential made of a matching key pair, so there is no shared secret to steal or type into a fake page. The private key stays on your device, and the service holds only the public key. It replaces the password, or acts as a strong second step.

The rules behind it have just been finalized. The World Wide Web Consortium (W3C) published Web Authentication Level 3 as a W3C Recommendation on August 25, 2026. The document explains that a credential is scoped to the service that created it, so only that service's own web origins can use it.

That scoping is why passkeys resist phishing. A fake login page lives at a different address, so the browser has nothing to offer it. For a small business, the most common attack is a convincing fake sign-in page, and passkeys shut that door.

Which Sign-In Options Do You Have Today?

Most small teams already use passwords plus a code from a text message or an app. The Cybersecurity and Infrastructure Security Agency (CISA) explains that multifactor authentication adds a second step such as a code from an authenticator app, which changes every 30 seconds, or a biometric check. It tells people to turn it on for every account that offers it.

That is still good advice, and it remains step one. Passkeys are the next step up. The same CISA page points readers to phishing-resistant MFA and FIDO as the strongest option. In practice, passkeys are the easy-to-use form of that idea.

Keep the difference clear. A six-digit code can still be typed into a fake website. A passkey cannot be, because the device checks the address first.

How Do You Enable Passkeys in Microsoft Entra?

You enable passkeys in the Microsoft Entra admin center under the Authentication methods policies. Microsoft's guide says passkeys are available in all Entra ID editions, including Free, with no extra licenses. You need at least the Authentication Policy Administrator role to change the policy.

Follow these steps from Microsoft's passkey setup guide.

Two details trip people up. Users must complete multifactor authentication within the past five minutes before they can register a passkey. And guest users, including B2B collaboration accounts, cannot register passkeys at all.

Should You Choose Device-Bound or Synced Passkeys?

Choose synced passkeys for most staff and device-bound passkeys for admins and anyone with access to money. A synced passkey is stored in a cloud provider such as Apple's iCloud Keychain or Google Password Manager, so it survives a lost phone. A device-bound one stays on a single device or key.

Microsoft describes synced passkeys as phishing-resistant but with the same security posture as other unattested authenticators. Attestation, a check of the authenticator's make and model, is not supported for synced passkeys. Admins and executives are the people for whom attestation matters most.

Password managers can also hold passkeys. Microsoft's guide lists 1Password and Bitwarden among other providers, which may need a browser extension or app. Our comparison of 1Password and Bitwarden for business covers which one fits a small team.

How Do You Allow Passkeys in Google Workspace?

In Google Workspace, passkeys work as a 2-Step Verification method by default, and a separate admin setting lets users skip passwords entirely. Google's announcement says the setting, named "Allow users to skip passwords at sign-in," is off by default. People can start at g.co/passkeys once it is allowed.

Google's Workspace Updates post placed the setting under Security and then Passwordless in the Admin console. That post dates from 2023, so the menu path may have moved. Search the Admin console for "passkeys" or check Google's current Admin Help before you rely on the path.

The two platforms differ in how they let you scope the change. Entra uses groups and profiles. Google lets you apply settings by organizational unit. Either way, switch it on for a small group first.

If you are still deciding between the two suites, our Microsoft 365 and Google Workspace pricing comparison shows what each costs per user.

How Should You Roll Passkeys Out to the Team?

Roll out in three waves: a pilot of two or three people, then admins and finance, then everyone else. Give each wave a week, collect problems, and fix them before the next group starts. A rollout that takes a month beats a lockout that takes a week to untangle.

Use this plan to keep it orderly.

Keep it simple for staff. Tell them what will change on screen, what to tap and who to ask. A short message on the day beats a long policy nobody reads.

What Is Your Recovery Plan if Someone Loses a Device?

Your recovery plan decides whether passkeys help or hurt. Every person needs at least two ways in: a second passkey on another device or a security key, plus a documented admin reset. Without this, a lost phone becomes a day of lost work.

Write down who can verify an identity and how. A video call and a manager's confirmation are better than an email reply from the "employee." Attackers now target password resets and account recovery because the sign-in itself is harder to fool.

Also keep two admin accounts that are separate from daily work. The National Institute of Standards and Technology (NIST) maintains a small business cybersecurity resource page with plain-language guidance you can borrow for a short written policy.

What Will Passkeys Cost You?

For many teams the software cost is zero. Microsoft says passkeys in Entra ID need no extra licenses and work in the Free edition. Google's announcement describes passkeys as an admin setting rather than a paid add-on, though you should confirm that against your own plan.

The real costs are time and hardware. A pilot takes a few hours of an admin's week. Hardware security keys for admins cost money, and a backup key for each admin doubles that. For a ten-person office, a pair of keys for two admins is a small, one-time expense.

Weigh that against the cost of a stolen account. A single successful phishing attack on a finance login can cost far more than every key you will ever buy.

What Still Needs a Password?

Many business apps still do not support passkeys, so plan to keep a password manager. Accounting tools, vendor portals and older systems often accept only a password and a code. Store those in a shared vault with limited access.

It also helps to secure your email domain at the same time. Our guide to setting up SPF, DKIM and DMARC for small business email pairs well with this one, since fake sign-in pages usually arrive in fake email.

Conclusion

Passkeys are now practical for a small business. The standard is final, Microsoft Entra supports them in every edition and Google Workspace offers them as an admin setting. The safe path is a pilot, a clear recovery plan and admins first.

Little iApps will keep checking how these admin menus change. Start this week by turning on passkeys for yourself, register a backup, and then invite two coworkers to try it before you widen the rollout.