# Passkeys for email: how do they stop phishing, and how do you turn them on?

URL: https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Setup guides
Author: iBlockSpam Team

> How passkeys stop the email phishing that beats SMS and app codes, synced vs device-bound keys, and how to turn them on in Microsoft 365 and Google Workspace.

## Short answer

A passkey is a sign-in credential based on FIDO2 and WebAuthn. Your device holds a private key that only works on the real site it was made for, so a fake login page gets nothing to reuse. NIST and CISA count it as phishing-resistant MFA; SMS, app codes and push approvals aren't. Microsoft 365 and Google Workspace support passkeys.

Most email account takeovers start with a fake sign-in page. Ordinary multi-factor authentication (MFA) slows that down, but codes and push approvals can be relayed by a [phishing kit](https://iblockspam.com/blog/phishing-as-a-service-kits) in real time. Passkeys close that gap. This guide explains how they work, which kind to choose, and the exact settings to turn them on in Microsoft 365 and Google Workspace.

## What is a passkey?

A passkey is a sign-in credential built on the FIDO2 and WebAuthn standards that replaces or backs up a password with a cryptographic key pair. When you create one, the FIDO Alliance's [Passkey Central](https://www.passkeycentral.org/introduction-to-passkeys/how-passkeys-work) explains, "a public key is sent to the online service and associated with the user's account", while "the user's device or security key creates and securely retains the private key". To sign in, you unlock your device with a fingerprint, face or PIN, and the device proves it holds the private key.

A few terms you'll see:

- **FIDO2** is the family of standards from the FIDO Alliance. **WebAuthn** is the browser part, published by the W3C.
- **Authenticator** is whatever holds the private key: a phone, a laptop, a password manager or a USB or NFC **security key**.
- **Relying party** is the website or service you sign in to, such as Microsoft or Google.

The [WebAuthn Level 3 specification](https://www.w3.org/TR/webauthn-3/) says each credential is "scoped to a given WebAuthn Relying Party", and that scoping "is enforced jointly by conforming User Agents and authenticators". In plain terms, a passkey made for Microsoft's real sign-in site can't be used on a lookalike domain.

## Why are passkeys phishing-resistant when MFA codes aren't?

Passkeys are phishing-resistant because the browser only offers them to the domain they were created for, so there's nothing a user can type into a fake page. A one-time code or a push approval works the other way: the user reads or approves something, and a phishing proxy relays it to the real site. That's how [adversary-in-the-middle phishing](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) steals sessions from users who completed MFA correctly.

[NIST SP 800-63B-4, section 3.2.5](https://pages.nist.gov/800-63-4/sp800-63b.html) puts it formally: authenticators "that involve the manual entry of an authenticator output" "SHALL NOT be considered phishing-resistant", and "phishing resistance requires single- or multi-factor cryptographic authentication". CISA's [phishing-resistant MFA fact sheet](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf) calls FIDO/WebAuthn "the only widely available phishing-resistant authentication" and says "phishing-resistant MFA is the gold standard".

| Sign-in method | What a fake page can capture | Phishing-resistant? |
|---|---|---|
| Password only | The password | No |
| Password + SMS or voice code | Password and code, relayed in real time | No; CISA says SMS "should only be used as a last resort" |
| Password + authenticator app code | Password and code, relayed in real time | No |
| Password + push approval (with or without number matching) | Password; the user approves the attacker's sign-in | No |
| Passkey on a phone, laptop or password manager | Nothing usable; the browser won't offer it to the wrong domain | Yes |
| FIDO2 security key | Nothing usable | Yes |
| Certificate-based authentication or smart card | Nothing usable | Yes |

CISA also makes the point that email is a good place to start: "most hosted mail and SSO systems support FIDO", and they're good starting points "because the data is valuable".

## Should you use synced or device-bound passkeys?

Use synced passkeys for most staff and device-bound passkeys or security keys for administrators. The difference is where the private key lives.

| | Synced passkey | Device-bound passkey or security key |
|---|---|---|
| Where the key lives | Encrypted and synced through a passkey provider such as Apple Passwords (iCloud Keychain) or Google Password Manager | On one device or one security key, and never leaves it |
| Lost device | Still available on the user's other devices | Gone; the user needs another method |
| Attestation (proof of make and model) | Not supported, per Microsoft | Supported |
| NIST level | Up to AAL2; "SHALL NOT be used at AAL3" | Can meet AAL3 with suitable hardware |
| Good fit | Most employees, small teams | Global admins, finance approvers, executives |

[Microsoft's passkey guidance](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2) says to "treat synced passkeys as phishing-resistant credentials but with the same security posture as other unattested authenticators." NIST's Appendix B adds that access to the sync fabric itself should be protected by "AAL2-equivalent MFA". In practice, a synced passkey is only as safe as the Apple, Google or password-manager account it syncs through, so protect that account well.

## Can passkeys still be phished or bypassed?

Yes, in a few specific ways, and most of them come down to weaker methods left in place.

- **Downgrade to a weaker method.** If the account still accepts a password plus an SMS code, a phishing page simply asks for those instead. Passkeys only stop phishing once you **require** a phishing-resistant method, not just allow one.
- **Registration and recovery.** An attacker who gets a session can try to add their own method. Microsoft requires users to complete MFA within the past five minutes before registering a passkey, but you should still protect security-info registration and recovery processes.
- **Attacks that use the real site.** [Device code phishing](https://iblockspam.com/blog/device-code-phishing-microsoft-365) and [OAuth consent phishing](https://iblockspam.com/blog/oauth-consent-phishing-microsoft-365) trick users into approving access on Microsoft's genuine pages, so the domain check doesn't help.
- **Malware on the device.** A passkey doesn't stop an infostealer that copies session cookies from a compromised computer.
- **Business email compromise without a login.** Lookalike domains and display-name tricks don't need your users' credentials at all. That's a job for inbound filtering and payment checks, covered in our [BEC prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention).

## How do you turn on passkeys in Microsoft 365?

You turn on passkeys in the Microsoft Entra admin center under the **Passkey (FIDO2)** authentication method. Microsoft says passkeys "are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free. No extra licenses are required." The steps below are from [Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2) at the time of writing (November 2026).

1. Sign in to the Microsoft Entra admin center as at least an **Authentication Policy Administrator**.
2. Go to **Entra ID** > **Security** > **Authentication methods** > **Policies**, and select **Passkey (FIDO2)**.
3. If prompted, opt in to **passkey profiles** using the banner link. Microsoft notes you can't opt out afterwards, and your existing settings move into a **Default passkey profile**.
4. On **Configure**, set **Allow self-service set up** to **Yes**, or users can't register passkeys in Security info.
5. In the profile, choose **Passkey types**: **Device-bound**, **Synced** or both. Microsoft says that if you haven't opted in to profiles and attestation enforcement is off, synced passkeys are already enabled.
6. For admins, create a second profile with **Device-bound** only and **Enforce attestation** set to **Yes**. Up to three profiles are supported, including the default.
7. On **Enable and Target**, add your pilot group and assign the right profile.
8. Have users register at [Security info](https://mysignins.microsoft.com/security-info).

The same policy is exposed in Microsoft Graph at `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/fido2` (permission `Policy.ReadWrite.AuthenticationMethod`). In PowerShell, read the current settings with:

```powershell
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"
Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration `
  -AuthenticationMethodConfigurationId Fido2
```

and change them with `Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration`, as shown on Microsoft's [Graph reference page](https://learn.microsoft.com/en-us/graph/api/fido2authenticationmethodconfiguration-update).

### How do you require passkeys instead of just allowing them?

Create a Conditional Access policy whose grant control is **Require authentication strength** with the built-in **Phishing-resistant MFA** strength. That strength accepts Windows Hello for Business or platform credential, a FIDO2 security key (passkeys) and certificate-based authentication; Microsoft Authenticator phone sign-in counts as passwordless but not phishing-resistant ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths)). Conditional Access needs **Microsoft Entra ID P1**. Start in report-only mode, and keep a break-glass account excluded. Our [AiTM guide](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) walks through the policy in more detail.

## How do you turn on passkeys in Google Workspace?

In Google Workspace, users can already add passkeys as a 2-Step Verification (2SV) method. Letting them sign in with a passkey instead of a password is a separate admin setting. Google's June 2023 [launch post](https://workspaceupdates.googleblog.com/2023/06/passkey-open-beta.html) said: "By default, this setting is off". The steps below are from [Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/users/allow-users-to-skip-passwords-at-sign-in) at the time of writing (November 2026).

1. In the Admin console, go to **Menu** > **Security** > **Authentication** > **Passwordless**. You need the Security Settings administrator privilege.
2. Click **Skip passwords**, optionally choose an organizational unit, and check **Allow users to skip their password and authenticate with a passkey**.
3. Click **Save** (or **Override** for a child organizational unit).
4. Tell users to turn on skip passwords and add a passkey to their account.
5. To limit passkeys to hardware, open **Passkeys restriction** and select **Allow passkeys on hardware security keys only**. Google warns this stops passkeys on phones and computers from working, so check **Reporting** > **User Reports** > **Security** first.

Turning on skip passwords "doesn't deactivate or remove the user's existing password". To make a passkey or security key the **only** accepted second step, use the **Only security key** 2SV enforcement option, which Google says now supports both security keys and passkeys. Our [Google Workspace 2-Step Verification guide](https://iblockspam.com/blog/google-workspace-2-step-verification-enforcement) covers enforcement, backup codes and lockout risks.

## How do you add a passkey to a personal Gmail or Outlook.com account?

- **Google Account:** go to `myaccount.google.com/signinoptions/passkeys`, select **Create a passkey** and unlock your device when prompted. Repeat on each device you use ([Google Account Help](https://support.google.com/accounts/answer/13548313)).
- **Microsoft account (Outlook.com, Hotmail):** sign in to Advanced security options at `account.live.com/proofs/manage`, select **Add a new way to sign in or verify**, then **Face, Fingerprint, PIN, or Security Key**, and follow the prompts ([Microsoft Support](https://support.microsoft.com/account-billing/signing-in-with-a-passkey-09a49a86-ca47-406c-8acc-ed0e3c852c6d)).

Then remove SMS as a recovery method where you can, and keep your recovery codes somewhere safe.

## Passkey rollout checklist for a small business

1. **List high-risk accounts first:** global admins, anyone who approves payments, executives and their assistants.
2. **Give admins two device-bound methods each,** such as two security keys, so one lost key isn't a lockout.
3. **Enable passkeys for a pilot group** and let them register synced passkeys on the devices they already use.
4. **Document recovery:** who can reset a user, how identity is checked, and how a lost passkey is deleted from the account.
5. **Require phishing-resistant MFA** for the pilot with Conditional Access or Google's 2SV enforcement, in report-only or with a grace period first.
6. **Remove SMS and voice** wherever another method is registered.
7. **Expand to everyone,** then review sign-in logs for accounts still using weaker methods.
8. **Brief staff:** a sign-in page that suddenly asks for a code instead of your passkey is a warning sign, not a glitch.

## Next steps

- Start with your admin and finance accounts this week; they're the ones attackers want.
- If an account may already be compromised, revoke sessions and check rules before rolling anything out. See [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised).
- Passkeys protect the sign-in, not the inbox. Lookalike-domain and BEC emails still arrive. iBlockSpam filters phishing and spoofing at the MX before mail reaches [Microsoft 365](https://iblockspam.com/platforms/microsoft-365) or Google Workspace, and the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) helps you check where a suspicious message came from.

Browse more [setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Are passkeys safer than an authenticator app for email?

For phishing, yes. An authenticator app code or push approval can be typed or approved on a fake page and relayed to the real one. A passkey is tied to the real site's domain, so the browser won't use it on a lookalike. NIST says authenticators that need manual entry of an output can't be considered phishing-resistant.

### Do synced passkeys count as phishing-resistant MFA?

Yes, for phishing. Microsoft says to treat synced passkeys as phishing-resistant, but with the same security posture as other unattested authenticators. NIST allows syncable authenticators up to AAL2 and bars them from AAL3, because syncing means the private key can be exported. Use device-bound passkeys or security keys for admins if you need the stronger level.

### Does adding a passkey remove my email password?

No. In Google Workspace, turning on skip passwords doesn't deactivate or remove the user's existing password, and personal Microsoft and Google accounts keep their passwords unless you remove them. That matters, because an attacker can still phish the password or a weaker second factor unless your admin requires a phishing-resistant method.

### Do I need a Microsoft Entra P1 licence to use passkeys?

Not to use them. Microsoft says passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Free, with no extra licences. To require passkeys, for example with a Conditional Access policy that demands the phishing-resistant authentication strength, your tenant needs Microsoft Entra ID P1.

### What happens if an employee loses the phone that holds their passkey?

A synced passkey is still available on the user's other devices signed in to the same passkey provider. A device-bound passkey on that phone or a lost security key is gone, so the user needs another registered method or an admin-issued recovery option. An admin should delete the lost passkey from the account and have the user register a new one.

## Sources

- [NIST SP 800-63B-4: Authentication and Authenticator Management (sections 2.3.2 and 3.2.5, Appendix B)](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [CISA: Implementing Phishing-Resistant MFA (October 2022)](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)
- [W3C: Web Authentication Level 3](https://www.w3.org/TR/webauthn-3/)
- [FIDO Alliance Passkey Central: How passkeys work](https://www.passkeycentral.org/introduction-to-passkeys/how-passkeys-work)
- [Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-passkeys-fido2)
- [Microsoft Learn: Conditional Access authentication strengths](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths)
- [Google Workspace Admin Help: Allow users to skip passwords at sign-in](https://knowledge.workspace.google.com/admin/users/allow-users-to-skip-passwords-at-sign-in)
- [Google Account Help: Sign in with a passkey instead of a password](https://support.google.com/accounts/answer/13548313)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt