Passkeys and multi-factor authentication: how to stop paying for password resets.

Cyber · 6 min · written 30 October 2026 · by the IT-360 team · sources at the end

Why passwords are the problem

Most break-ins into small businesses start with a password that was reused, guessed or typed into a fake login page. Password resets are also the single most common ticket on any helpdesk, which is a cost that goes on forever. Multi-factor authentication stops the first; passkeys stop both.

MFA, done properly

Multi-factor authentication means a second proof when you sign in: a code from an authenticator app or a prompt on your phone. Text-message codes are better than nothing but can be intercepted; an app is the minimum we set up. Microsoft 365 can require it for everyone with one policy, and the same policy can block sign-ins from countries you never work from.

What a passkey is

A passkey is a cryptographic key stored on your phone or laptop and unlocked with the fingerprint, face or PIN you already use. The website never sees a secret it could lose. A fake site cannot ask for it either, because the key only works with the real one. Microsoft, Google and Apple accounts all support them, and Microsoft 365 can be set to prefer them.

A switch-over plan for 20 to 100 people

Month one: authenticator app for every Microsoft 365 user, enforced by policy, with a short video and a desk ready for the questions. Month two: passkeys for the directors and anyone who travels, because they are the most targeted and the most inconvenienced by codes. Month three: the other cloud services, starting with accounts and payroll. Password resets drop within weeks; the Staff Awareness page covers the training that goes with it.

Further reading on Insights: Cyber Essentials in 2026.

Sources

• NCSC: multi-factor authentication for online services, and passkey guidance.
• FIDO Alliance: passkeys overview.
• Microsoft: passkeys in Microsoft Entra ID.