Passkeys and FIDO2 - Simply Explained

0:00 Welcome to the M365 FM podcast, where we explore the people, ideas and technologies shaping the future of work. A newer way to sign in that Microsoft just made the default. Five billion passkeys are already in use worldwide, according to the Fido Alliance. That's a huge shift for something most of us still can't explain, and Microsoft has just made passkeys the default way to sign into Microsoft three hundred sixty five. You might think a passkey is just a password manager with a nicer name, but it's a completely different kind of key. It replaces the secret you type with something that never leaves your device. Welcome to the M365 FM podcast, where we explore the people, ideas, and technologies shaping the future of work. By the end of this, you'll know how passkeys work where they live in Microsoft three hundred sixty five and Azure, and the honest limits that come with them.

0:44 What a passkey actually is. Let's begin with the plain version, because people toss the word passkey around as if everyone already knows what it means. Passkey is simply a way to sign in that uses the same thing you already use to unlock your phone. That can be your face, your fingerprint, a short pin, or a pattern. You approve the sign in on your own device and you never type a password. Here's what makes it different from anything you've used before. A passkey is a matched pair of keys, and the two of them do very different jobs. One key is private. It lives on your device and it never leaves. The other key is public and it sits with the website or the app you signed up for. You need both halves of that pair to get in, and the pair is unique to that one place. A passkey you made for your work account does nothing at all on a copycat page, which is a detail worth holding onto for later.

1:27 Picture the moment you open outlook on your laptop, instead of typing a password and then digging your phone out for a six digit code, you touch the fingerprint reader and you're in for the person signing in. That's the entire experience, and it takes about two seconds. Some people worry that their fingerprint or their face is being uploaded somewhere, and it isn't. Your biometric stays on the device, and the website only gets a simple confirmation that the check went through. The standards behind it deserve one quick mention just so the acronyms stop being scary. Fido2 is the open standard that defines how passkeys work, and Webauthn is the part that lets your browser use them. Ctap handles how your device talks to a security key or a phone. You don't have to remember any of those names to use a passkey, but now they won't sound like a locked door.

2:08 So a passkey is a sign in credential, and it happens to be built on the Fido2 standards. The contrast that matters is a lot simpler than the acronyms. A password is a shared secret, and anything shared can be given away. A passkey isn't shared with anyone, not even the website you're signing into. Now here's where it gets interesting, because the way your device proves who you are is the exact thing that makes fishing stop working. How the keys do their work without ever sharing a secret. To see why this is safer, we have to look at what actually happens in the moment you sign in. It's a short back and forth, and the interesting part is everything that never gets sent anywhere. When you start signing in, you pick your passkey and the server sends back a one time challenge. Your device finds the private key, unlocks it with your face or your PIN, and uses it to sign that challenge.

2:49 From there, the service checks the signature with the public key it already holds, and if the two match you're in. Notice what's missing from that exchange. Your private key never leaves the device, and no password or code ever crosses the network. Nothing is in transit for anyone to grab, and nothing sits on a server that a breach could expose. There's also a neat trick for when the passkey isn't on the device you happen to be using. You scan a QR code with your phone, approve the sign in on the phone, and land on the laptop with Bluetooth. Just confirming the two devices are near each other. The real security doesn't lean on Bluetooth since it only proves you're in the same room. Microsoft describes passkeys as origin bound, which means the credential is tied to the exact website or app it was created for. Every sign in also needs you to be there in person to unlock it.

3:30 That's why nobody can call you up. Pretend to be your IT department and talk you into using your own passkey on a page they control. There's a second protection with a clunky name, and it's worth knowing. In plain words, it's called verifier impersonation resistance, and it simply means the authenticator only answers for the real site. If an attacker builds a perfect copy of your sign in page, your passkey still won't respond because it doesn't recognize that copy as the place it belongs to. Put those two ideas together and the payoff is obvious. Phishing works by getting you to hand over a secret, and a passkey leaves you with no secret to hand over. The challenge gets signed on your device, the private key stays put and the fake page is left holding nothing. That's the mechanism. And it's the reason security people sound almost excited about passkeys.

4:10 But here's the twist what makes phishing stop working isn't the encryption, and it isn't the hardware. It's that the credential itself can't be copied, moved, or typed into the wrong place. Why phishing stops working once the secret is gone. Fishing has one job, and that job is to trick a person into handing over a secret. It doesn't matter how convincing the page looks or how urgent the email sounds, because the whole trick collapses the moment there's nothing left to type. Take the code that arrives on your phone. It feels safe because it's the second step and it does block some attacks. But that code is still a secret. A determined attacker can spin up a fake page that asks you to enter it in real time, then use it before it expires. Security people call methods like this fishable because a person can still be talked into giving them away.

4:51 The scale here is not small. The Fido Alliance points to a three thousand percent rise in AI powered phishing aimed at corporate credentials. That's a reported figure, and it lines up with what shows up in our inboxes every week. The same group makes a blunter claim, which is that a pass key, standing alone is more secure than a password paired with a one time code. The reason comes back to the human being, not the technology. Most security advice quietly assumes people will get sharper, that they'll spot the fake link and never type the code. Passkeys dropped that assumption entirely because the fix is a credential that can't be handed to anyone, no matter how persuasive the ask. There's a quieter attack, too, and it doesn't need you to do anything wrong. When a company's password database leaks, attackers take those email and password pairs and try them everywhere else.

5:33 Betting that people reuse the same one with a passkey. A leaked server has no password to leak, and the same credential is useless on any other site. Honesty matters here, though. Phishing resistant covers the credential and it doesn't cover your whole life. Someone can still be tricked through other doors, like a provider account takeover or a phone call that gets them to approve something they shouldn't. A passkey raises the floor and it doesn't make you untouchable. So the promise is real, and it's also specific. You don't become a harder target because you got smarter overnight. You become one because the thing attackers used to take is no longer there to take. The only wrinkle is that not every passkey is built the same way, and the one you choose decides what happens on the day a device goes missing. The two kinds of passkey and which one is for you.

6:14 Once you accept that passkeys are safer, the next question is which kind you'll actually use. And there are two flavors. One travels with you and one stays in a single place. A synced passkey lives in a cloud account you already trust, like Apple's iCloud keychain or Google Password Manager. The key gets encrypted on your device before it's stored, and it syncs across your devices, so the passkey you create on your phone shows up on your laptop. Buy a new phone, sign into the same account and your passkeys come right back. A device bound passkey works differently because the private key is created on one physical thing and never leaves it. That thing can be a hardware security key. The small USB or tap to connect kind, or it can be the Microsoft Authenticator app on your phone. Here's where it gets interesting for Microsoft users.

6:56 Passkeys stored in the authenticator app are device bound, so they can't be synced, and losing the phone means losing that particular passkey. Microsoft has run the numbers on its own consumer accounts, and they're worth hearing. As reported figures, it says ninety nine percent of users successfully register a synced passkey, and that signing in is fourteen times faster than a password plus traditional MFA. About three seconds instead of sixty nine. It also reports that people are roughly three times more likely to get in successfully, with synced passkey at ninety five percent, compared with thirty. For most people, the picture is simple. Microsoft's own guidance points to synced passkeys because they're convenient. They survive a lost device, and they still stop phishing. For the people who guard the keys to the kingdom, like administrators and highly privileged accounts.

7:39 Microsoft recommends the device bound kind instead. A simple way to hold this is to picture two different people. A normal employee taps their face or their fingerprint, and signs in with the passkey already on their phone. An IT admin carries a little security key on a keyring, because that account is worth protecting with hardware that can't be copied into a cloud. Both of those are real passkeys and both beat a password. The choice comes down to how much convenience you want to trade for, how tightly you want to control where the key lives. The provider doesn't have to be Apple or Google either. Third party password managers like one password, and Dashlane can store and sync passkeys, which matters if you switch between an iPhone and a windows laptop. And if you'd rather keep everything off the cloud entirely. A hardware security key is the portable option that works across all of them.

8:21 What happens when your phone or key goes missing? This is the question everyone asks, usually with a little worry in their voice, and it's the right one to ask. The phone with your passkeys ends up in a taxi or at the bottom of a lake, and you need to know what that actually costs you if your passkey is synced, the answer is reassuring. The key is backed up in your cloud account, so when you sign into a new phone with that same account, your passkeys arrive with it. Losing the device is annoying, and it's not a lockout. If your passkey is device bound, the answer is tougher and it's the trade. You accepted a security key that goes missing or a phone that gets wiped takes that passkey with it and there's nothing to sync back. You need another way in, which is why the advice is to set up more than one passkey. The same way you keep a spare key for your house, Microsoft adds a practical detail that's easy to miss.

9:05 Passkeys don't expire on their own, so there's no built in clock forcing a refresh, and Microsoft recommends keeping an eye on them over time. If an admin needs to cut off access, they can revoke a passkey from your account, which is the escape hatch when a device is lost or stolen. There's also a small gotcha worth knowing if you use the Microsoft Authenticator app on Android, change your phone's PIN, or switch your sign in from a thumbprint to your face, and the passkey can be invalidated. When that happens, you sign in another way and simply create a new one. None of this is a reason to avoid passkeys, and it is a reason to plan ahead. Set up a second passkey somewhere safe, keep your account recovery details current, and the scary scenario turns into a minor inconvenience instead of a crisis. The best time to set that up is during setup, not after a loss.

9:47 When you register your first passkey, most services let you add a second one right away. That second one is what turns a bad day into a small annoyance. And this is where it stops being a personal choice because Microsoft is already pushing passkeys onto the work accounts we sign into every morning. Where passkeys already live in Microsoft three hundred sixty five and Azure. So far this has been about the concept, and now it's worth seeing where it already touches your working day. The home for this in Microsoft's world is something called Microsoft Entra ID, the identity service that sits behind signing into Microsoft three hundred sixty five. If that name is new to you, the simple version is that entry ID is the thing. Checking who you are. It's what runs the moment you open teams outlook or any of the other Microsoft three hundred sixty five apps.

10:29 It's also where your organization manages how people prove who they are. And that's exactly where passkeys show up. There's a change here that's worth marking on your calendar. As of September first, twenty twenty six, passkeys became the default authentication experience in Microsoft Entra. On top of that, Microsoft's own text message and voice call codes are being retired on February first, twenty twenty seven, which means the familiar six digit text is on its way out. For a normal person that shows up as a gentle nudge. The sign in screen you already use for teams and outlook starts asking you to set up a passkey, and over time, it becomes the default way in. Nobody is asking you to learn a new tool. They're asking you to approve sign ins with the face or the finger that already unlocks your phone. The Azure side of this is about reach, and it's the part that makes a passkey more than an app login.

11:12 A passkey can sign you into a windows eleven device that's joined to entra, and from there, it carries you into cloud and on premises resources through single sign on one. Approval on your device can unlock a lot of doors, which is convenient and also why the security matters. There's a control layer on top, and we can keep it to one plain sentence. Administrators can require passkeys through policy, and if they turn on something called attestation, they can restrict sign in to device bound passkeys. Only. If you use Microsoft's own tools, you'll need passkeys in a few places. The Microsoft Authenticator app can hold a device bound passkey for your work account, and entra can prompt people to register one during sign in. Administrators also get logs and reports so they can see passkey creation and usage, which keeps the whole rollout from being a black box.

11:55 One last Microsoft detail belongs here, mostly so it doesn't surprise you later. Passkeys aren't fully safe against future quantum computers yet, and Microsoft has a published plan to move to post-quantum cryptography, with a full transition targeted by twenty thirty three. That's a long way off, and it's good that someone is already working on it. Before you rush out and move every account at once. There's one limit in the whole picture. Even Microsoft admits it can't fully control this one yet, and it should shape how you roll this out. The honest catches nobody mentions. Every new security idea comes with a catch, and passkeys have a few worth saying out loud before we wrap up. A host who only tells you the good part isn't really helping. You start with visibility, which is the one Microsoft admits when a passkey is synced, administrators can't see or control exactly which devices hold a copy of it, and they can't ask where it has been synchronized.

12:41 That's described as an industry wide limit, not something unique to Microsoft, and it explains why a strict organization might choose device bound passkeys instead. Then there's the trade that comes with the strictest setting. If an organization enforces attestation, only device bound passkeys are allowed, and the synced passkey on your phone no longer counts. You get tighter control and you give up the easy travel with you option. Availability isn't even everywhere either. Passkeys aren't available for Microsoft Azure, operated by twenty one VNet in China. On top of that, some Android phones without the right secure hardware can't store passkey in the authenticator app at all. The technology is broad, though not universal. Old habits are stubborn, too. According to the Fido Alliance, fifty seven percent of organizations still rely on Fishable methods for their employees.

13:23 Main day to day sign in. The shift toward passkeys is real, and it's still incomplete, which means plenty of people listening will be typing passwords at work for a while. The numbers themselves deserve a caveat, including the ones in this episode. The big adoption and security figures come from the Fido Alliance and the vendors at sites, so treat them as reported claims rather than neutral science. They point in a clear direction, and a careful listener should still know who's doing the counting. Put all of that together. And the honest summary is this passkeys removed the single biggest way accounts get taken over and they don't fix everything. The one limit even Microsoft can't solve yet is knowing exactly where a synced passkey has traveled. There's one more thing worth a sentence, and it's a slow moving one. Some regulations and compliance rules haven't caught up yet, and they still don't officially count passkeys as multi-factor authentication.

14:09 In every case, that's a paperwork gap rather than a security one, and it's the kind of thing that tends to close over time. A short recap and a question for you. So let's pull this back to the simple version. A passkey replaces the secret you type with a key that stays on your device. It makes fishing stop working because there's nothing to hand over, and it's already the default way Microsoft Entra wants you to sign in. You don't have to understand the cryptography to benefit from it, and you do have to set up a backup passkey before you need one. I'll leave you with one question. If you could move just one account to a passkey this week, which one would it be and why that one? Think about it, because that account is probably the one an attacker would want most if this made the topic feel less intimidating. Subscribe to M365 FM to master the tools and the mindset shaping the future of work.