Passkeys for email: how do they stop phishing, and how do you turn them on?

Most email account takeovers start with a fake sign-in page. Ordinary multi-factor authentication (MFA) slows that down, but codes and push approvals can be relayed by a phishing kit in real time. Passkeys close that gap. This guide explains how they work, which kind to choose, and the exact settings to turn them on in Microsoft 365 and Google Workspace.

What is a passkey?

A passkey is a sign-in credential built on the FIDO2 and WebAuthn standards that replaces or backs up a password with a cryptographic key pair. When you create one, the FIDO Alliance's Passkey Central explains, "a public key is sent to the online service and associated with the user's account", while "the user's device or security key creates and securely retains the private key". To sign in, you unlock your device with a fingerprint, face or PIN, and the device proves it holds the private key.

A few terms you'll see:

• FIDO2 is the family of standards from the FIDO Alliance. WebAuthn is the browser part, published by the W3C.
• Authenticator is whatever holds the private key: a phone, a laptop, a password manager or a USB or NFC security key.
• Relying party is the website or service you sign in to, such as Microsoft or Google.

The WebAuthn Level 3 specification says each credential is "scoped to a given WebAuthn Relying Party", and that scoping "is enforced jointly by conforming User Agents and authenticators". In plain terms, a passkey made for Microsoft's real sign-in site can't be used on a lookalike domain.

Why are passkeys phishing-resistant when MFA codes aren't?

Passkeys are phishing-resistant because the browser only offers them to the domain they were created for, so there's nothing a user can type into a fake page. A one-time code or a push approval works the other way: the user reads or approves something, and a phishing proxy relays it to the real site. That's how adversary-in-the-middle phishing steals sessions from users who completed MFA correctly.

NIST SP 800-63B-4, section 3.2.5 puts it formally: authenticators "that involve the manual entry of an authenticator output" "SHALL NOT be considered phishing-resistant", and "phishing resistance requires single- or multi-factor cryptographic authentication". CISA's phishing-resistant MFA fact sheet calls FIDO/WebAuthn "the only widely available phishing-resistant authentication" and says "phishing-resistant MFA is the gold standard".

CISA also makes the point that email is a good place to start: "most hosted mail and SSO systems support FIDO", and they're good starting points "because the data is valuable".

Should you use synced or device-bound passkeys?

Use synced passkeys for most staff and device-bound passkeys or security keys for administrators. The difference is where the private key lives.

Microsoft's passkey guidance says to "treat synced passkeys as phishing-resistant credentials but with the same security posture as other unattested authenticators." NIST's Appendix B adds that access to the sync fabric itself should be protected by "AAL2-equivalent MFA". In practice, a synced passkey is only as safe as the Apple, Google or password-manager account it syncs through, so protect that account well.

Can passkeys still be phished or bypassed?

Yes, in a few specific ways, and most of them come down to weaker methods left in place.

• Downgrade to a weaker method. If the account still accepts a password plus an SMS code, a phishing page simply asks for those instead. Passkeys only stop phishing once you require a phishing-resistant method, not just allow one.
• Registration and recovery. An attacker who gets a session can try to add their own method. Microsoft requires users to complete MFA within the past five minutes before registering a passkey, but you should still protect security-info registration and recovery processes.
• Attacks that use the real site. Device code phishing and OAuth consent phishing trick users into approving access on Microsoft's genuine pages, so the domain check doesn't help.
• Malware on the device. A passkey doesn't stop an infostealer that copies session cookies from a compromised computer.
• Business email compromise without a login. Lookalike domains and display-name tricks don't need your users' credentials at all. That's a job for inbound filtering and payment checks, covered in our BEC prevention guide.

How do you turn on passkeys in Microsoft 365?

You turn on passkeys in the Microsoft Entra admin center under the Passkey (FIDO2) authentication method. Microsoft says passkeys "are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free. No extra licenses are required." The steps below are from Microsoft Learn at the time of writing (November 2026).

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Go to Entra ID > Security > Authentication methods > Policies, and select Passkey (FIDO2).
3. If prompted, opt in to passkey profiles using the banner link. Microsoft notes you can't opt out afterwards, and your existing settings move into a Default passkey profile.
4. On Configure, set Allow self-service set up to Yes, or users can't register passkeys in Security info.
5. In the profile, choose Passkey types: Device-bound, Synced or both. Microsoft says that if you haven't opted in to profiles and attestation enforcement is off, synced passkeys are already enabled.
6. For admins, create a second profile with Device-bound only and Enforce attestation set to Yes. Up to three profiles are supported, including the default.
7. On Enable and Target, add your pilot group and assign the right profile.
8. Have users register at Security info.

The same policy is exposed in Microsoft Graph at PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/fido2 (permission Policy.ReadWrite.AuthenticationMethod). In PowerShell, read the current settings with:

Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"
Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
  -AuthenticationMethodConfigurationId Fido2

and change them with Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration, as shown on Microsoft's Graph reference page.

How do you require passkeys instead of just allowing them?

Create a Conditional Access policy whose grant control is Require authentication strength with the built-in Phishing-resistant MFA strength. That strength accepts Windows Hello for Business or platform credential, a FIDO2 security key (passkeys) and certificate-based authentication; Microsoft Authenticator phone sign-in counts as passwordless but not phishing-resistant (Microsoft Learn). Conditional Access needs Microsoft Entra ID P1. Start in report-only mode, and keep a break-glass account excluded. Our AiTM guide walks through the policy in more detail.

How do you turn on passkeys in Google Workspace?

In Google Workspace, users can already add passkeys as a 2-Step Verification (2SV) method. Letting them sign in with a passkey instead of a password is a separate admin setting. Google's June 2023 launch post said: "By default, this setting is off". The steps below are from Google Workspace Admin Help at the time of writing (November 2026).

1. In the Admin console, go to Menu > Security > Authentication > Passwordless. You need the Security Settings administrator privilege.
2. Click Skip passwords, optionally choose an organizational unit, and check Allow users to skip their password and authenticate with a passkey.
3. Click Save (or Override for a child organizational unit).
4. Tell users to turn on skip passwords and add a passkey to their account.
5. To limit passkeys to hardware, open Passkeys restriction and select Allow passkeys on hardware security keys only. Google warns this stops passkeys on phones and computers from working, so check Reporting > User Reports > Security first.

Turning on skip passwords "doesn't deactivate or remove the user's existing password". To make a passkey or security key the only accepted second step, use the Only security key 2SV enforcement option, which Google says now supports both security keys and passkeys. Our Google Workspace 2-Step Verification guide covers enforcement, backup codes and lockout risks.

How do you add a passkey to a personal Gmail or Outlook.com account?

• Google Account: go to myaccount.google.com/signinoptions/passkeys, select Create a passkey and unlock your device when prompted. Repeat on each device you use (Google Account Help).
• Microsoft account (Outlook.com, Hotmail): sign in to Advanced security options at account.live.com/proofs/manage, select Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key, and follow the prompts (Microsoft Support).

Then remove SMS as a recovery method where you can, and keep your recovery codes somewhere safe.

Passkey rollout checklist for a small business

1. List high-risk accounts first: global admins, anyone who approves payments, executives and their assistants.
2. Give admins two device-bound methods each, such as two security keys, so one lost key isn't a lockout.
3. Enable passkeys for a pilot group and let them register synced passkeys on the devices they already use.
4. Document recovery: who can reset a user, how identity is checked, and how a lost passkey is deleted from the account.
5. Require phishing-resistant MFA for the pilot with Conditional Access or Google's 2SV enforcement, in report-only or with a grace period first.
6. Remove SMS and voice wherever another method is registered.
7. Expand to everyone, then review sign-in logs for accounts still using weaker methods.
8. Brief staff: a sign-in page that suddenly asks for a code instead of your passkey is a warning sign, not a glitch.

Next steps

• Start with your admin and finance accounts this week; they're the ones attackers want.
• If an account may already be compromised, revoke sessions and check rules before rolling anything out. See signs your email account is compromised.
• Passkeys protect the sign-in, not the inbox. Lookalike-domain and BEC emails still arrive. iBlockSpam filters phishing and spoofing at the MX before mail reaches Microsoft 365 or Google Workspace, and the free Email Header Analyzer helps you check where a suspicious message came from.

Browse more setup guides.