Microsoft Is Prompting Employees to Create Passkeys

An employee signs in to Microsoft 365, completes the usual verification step, and sees a request to create a passkey. The message is unfamiliar, so the employee closes it and asks whether the company changed something.

That scene is becoming more common. Beginning September 1, 2026, Microsoft started automatically enabling passkeys in its authentication policy for users who were enabled for SMS or voice verification. Those users may be prompted to register a passkey after signing in and completing multifactor authentication. Microsoft allows the prompt to be postponed, but the change gives businesses a reason to review their sign-in plan now.

The prompt should lead to a short, organized conversation among IT, leadership, and the people who support employees. Passkeys can make sign-in easier and more resistant to phishing, but a smooth rollout still depends on device choices, recovery steps, and clear guidance.

Why More Employees Are Seeing a Passkey Prompt

Microsoft is moving customers away from Microsoft-provided SMS and voice authentication and recommends passkeys as the main migration path where they fit. The September policy change does not force every employee to stop using a password immediately. It brings eligible users into scope for passkey registration and can display a setup reminder during sign-in.

Organizations can manage the settings, choose who is included, and use a registration campaign for a staged rollout. That administrative control matters because the right approach may differ for regular employees, executives, shared-device users, and people with elevated administrative access.

The broader direction is clear. The FIDO Alliance reported in May 2026 that 68 percent of surveyed organizations had deployed or were actively deploying passkeys for employee sign-ins. Support has also expanded across Microsoft Entra ID, Google Workspace, major operating systems, and password managers.

What Is a Passkey in Plain English?

A passkey is a sign-in credential that is stored on an approved device, security key, or passkey provider. The employee unlocks it with something already familiar, such as a face scan, fingerprint, or device PIN. The biometric information stays on the device; it is used locally to unlock the credential.

Unlike a password, the secret part of a passkey is not typed into a website. That design makes it much harder for a fake sign-in page to trick an employee into handing over reusable credentials. Government guidance from CISA recommends phishing-resistant authentication and identifies FIDO-based methods, including passkeys, as strong options.

A passkey may be synced through a trusted provider so it is available on more than one device, or it may be bound to a specific device or physical security key. The choice affects convenience, control, and recovery.

Schedule an IT & Cybersecurity Consultation

Passkeys Do Not Remove Every Password Overnight

Most businesses use many applications, and they will not all adopt passkeys at the same pace. Some systems will continue to rely on passwords and existing multifactor authentication. Other applications may support a passkey for sign-in but still use a password for account recovery or a legacy workflow.

Employees need an accurate message: the organization is improving selected sign-in methods, not declaring that passwords have vanished everywhere. Clear scope prevents people from ignoring legitimate prompts or assuming that any request involving a passkey is automatically approved.

Make Four Decisions Before a Broad Rollout

1. Decide which users and applications belong in the first pilot. A small group with common devices and accessible support is easier to learn from than the whole company.
2. Choose which passkey types are allowed. Synced passkeys may be practical for many employees, while device-bound passkeys or hardware security keys may fit administrators and other privileged roles.
3. Document the recovery path for a lost, replaced, or reset device. Include identity verification, removal of the old credential, registration of a replacement, and an approved temporary sign-in option.
4. Prepare employee instructions and help desk responses. Show what the real enrollment prompt looks like, where it should appear, and whom to contact when the screen or device does not match the guide.

Schedule an IT & Cybersecurity Consultation

Pilot With Real People and Real Devices

A pilot should include the laptops, phones, browsers, and work locations employees actually use. Test initial registration, a normal workday sign-in, access from a second approved device, and the experience after a device restart. Include at least one recovery exercise using a spare or replacement device.

Ask participants to note where language is confusing or where a prompt appears different from the instructions. Those observations are valuable support data. A technically successful setup can still create avoidable tickets if employees cannot tell whether they should use a fingerprint, scan a QR code, open an authenticator app, or choose another option.

Microsoft provides activity reporting and targeted passkey profiles for organizations that want to measure adoption and control the rollout. Google Workspace also offers administrative settings and reporting for passkey use. The exact controls depend on the identity platform and license level in use.

Prepare for Lost Phones Replacements and Support Calls

Recovery is part of the sign-in design. Before expanding the pilot, confirm that more than one authorized person can assist with recovery and that support staff know how to verify an employee’s identity. Remove credentials tied to lost devices promptly, and avoid using an informal phone call or a manager’s recognition as the only verification step.

Keep an approved fallback for the situations that do not fit the standard path. Traveling employees, shared workstations, accessibility needs, and devices that cannot meet the technical requirements may need a different method. Document exceptions and review them rather than letting temporary workarounds become permanent.

Turn the New Prompt Into a Manageable Sign In Project

Start by reviewing current authentication methods and identifying users still dependent on SMS or voice. Configure a small pilot, test enrollment and recovery, prepare plain-language instructions, and then expand in groups while watching adoption and support volume.

Pearl Solutions Group provides cybersecurity services and Microsoft 365 security support that can help businesses assess authentication settings, plan a passkey rollout, and build reliable recovery procedures. The best outcome is pleasantly ordinary: employees understand the prompt, sign-in becomes easier, and support already knows what to do when a device changes.

Schedule an IT & Cybersecurity Consultation