Passkeys vs Passwords: Why UK Cyber Chiefs Just Called Time on the Password

On Thursday, April 23, 2026, the UK’s National Cyber Security Centre (NCSC) — part of GCHQ — officially recommended that consumers stop using passwords wherever passkeys are available, calling phishing-resistant passkey authentication the “first choice” for online sign-in. For small and mid-sized businesses across Northern Ontario, this isn’t just a headline from across the Atlantic. It’s a signal that the global authentication playbook is changing, and Microsoft is already flipping the switch inside your Microsoft 365 tenant — passkey auto-migration runs through late June 2026. Here’s what’s happening, why it matters, and how to prepare before that window closes.

The Short Version

• The UK’s NCSC now recommends passkeys over passwords for consumer logins, citing stronger phishing resistance and a better user experience.
• Microsoft is auto-enabling passkey profiles across Microsoft Entra ID tenants that already have FIDO2 enabled — automatic migration runs from early May through late June 2026.
• Passkeys are built on public-key cryptography. Nothing phishable is ever shared with the website you log into.
• For SMBs, the move is mostly good news — but recovery, device loss, and legacy apps still need planning.

What the NCSC Actually Said

On Day Two of CYBERUK 2026 in Glasgow, the NCSC published a new technical report (Traditional user and FIDO2 credentials personal use) concluding that passkeys are at least as secure — and generally more secure — than pairing the strongest password with two-step verification (2SV), including SMS-based codes. Jonathon Ellison, the NCSC’s Director for National Resilience, said: “Adopting passkeys wherever you can is a strong step towards a safer, simpler login experience.”

This is a meaningful shift. For decades, the official line from Western cyber agencies has been some variant of “pick a strong password, don’t reuse it, add MFA.” The NCSC is now telling the public that, where passkeys are supported, this old advice should step aside. The agency also pointed to new Google data showing UK users already lead global passkey adoption — just over half of active Google service users in the UK have a passkey registered.

Canada’s equivalent agency, the Canadian Centre for Cyber Security (CCCS), has not yet issued an equally bold consumer directive. But the Cyber Centre already publishes guidance aligned with FIDO-based authentication, and the industry direction is unmistakable — Apple, Google, and Microsoft have all committed to passwordless futures built on the same open standard.

What Is a Passkey, Exactly?

A passkey is a digital credential that replaces a password. Instead of memorising a string of characters, your device (phone, laptop, tablet, or hardware key) generates a cryptographic key pair when you register with a website or app:

• The private key stays on your device — protected by Face ID, fingerprint, Windows Hello, or a PIN.
• The public key is stored by the service you’re logging into.

When you sign in, your device proves it holds the private key without ever sending it. There’s no shared secret for an attacker to phish, and no password database that can be breached to hand over your credentials.

For the end user, the experience is almost invisible: unlock your device the same way you already do, and you’re in. The NCSC’s April 2026 announcement cites passkey sign-ins as up to eight times faster than logging in with a username, password and two-step verification code.

Why Passkeys Beat Passwords for Business Security

Most breaches start with stolen credentials. Phishing, credential stuffing, and brute-force attacks all depend on a password existing somewhere it can be captured, guessed, or reused. Passkeys close those doors:

• Phishing-resistant by design. A passkey is tied to the exact domain it was registered with. A lookalike site can’t trick your device into authenticating.
• No reuse across sites. Each passkey is unique to each service, so a breach at one vendor doesn’t cascade.
• Nothing useful to steal server-side. Only the public key sits on the provider’s servers. Leaked, it reveals nothing an attacker can use.
• No weak-password problem. Users can’t pick “Summer2026!” as a passkey. Cryptographic strength is built in.
• Lower support burden. Fewer password resets, fewer locked-out users, fewer SMS codes that never arrive.

For an MSP client with 10 to 50 seats, that last point matters. Every password reset ticket has a dollar cost. Every SMS-based MFA code depends on a text message that may arrive late or not at all. Every phishing compromise risks a five-figure incident response engagement. Passkeys quietly erase a chunk of that overhead — and stack neatly with the rest of a zero-trust security model for small business.

Microsoft Is Auto-Enabling Passkeys — Here’s the Timeline

If your business runs Microsoft 365 (and most SMBs do), this is the part that needs attention. According to Microsoft’s Message Center notice MC1221452, Entra ID is rolling out passkey profiles and synced passkeys on the following schedule for worldwide public cloud tenants:

• Early to late March 2026: General Availability rollout of passkey profiles for tenants that opt in.
• Early May through late June 2026: Automatic migration for tenants that already had FIDO2 enabled but did not opt in. Microsoft moves existing configurations into a default passkey profile, preserving current restrictions and user targeting.

Only tenants with Passkeys (FIDO2) already enabled are in scope for the automatic migration — greenfield tenants aren’t being force-switched. But if you (or your previous IT provider) turned on FIDO2 at any point, Microsoft will quietly update your configuration whether you’re watching or not. The passkeyType property defaults based on your current attestation setting: device-bound only if attestation is enforced, or both device-bound and synced passkeys if it isn’t.

Separately, per Microsoft Message Center MC1282568, Entra passkeys on Windows reached General Availability in late April 2026, letting users create passkeys on any Windows device — not just Entra-joined corporate laptops. That’s a meaningful change for BYOD and hybrid work scenarios.

The Honest Caveats Every SMB Owner Should Know

Passkeys aren’t a silver bullet, and we say that up front with every client. A few realities to plan around:

• Device loss is a real recovery scenario. If a user’s only passkey lives on a single phone and they drop it in Lake Superior, you need a documented recovery path — synced passkeys, a backup device, or a hardware key in a safe.
• Not every app supports passkeys yet. Line-of-business software, older VPN appliances, and some industry-specific platforms still require passwords. A business password manager and MFA remain essential for those gaps.
• Synced vs device-bound is a policy decision. Synced passkeys (stored in iCloud Keychain, Google Password Manager, or a third-party manager) are easier for users. Device-bound passkeys on hardware keys are more secure but less forgiving. Most SMBs should run a mix based on role.
• Admin and privileged accounts need stricter rules. Global Administrators, break-glass accounts, and finance approvers should generally be pinned to hardware-backed, attested passkeys — not synced ones.
• User education still matters. People need to understand what a passkey is before they dismiss the Windows Hello prompt or delete the “weird blue screen asking about my face.”

What SMBs Should Do Before the June Migration

The Microsoft auto-migration window runs through late June 2026, which means now is the time to get intentional about how passkeys land in your environment. Phishing attacks against SMBs are getting smarter — see our coverage of the latest social engineering tactics — and passkey adoption is one of the few controls that meaningfully changes the attacker’s economics. A responsible rollout usually looks like this:

1. Inventory your current authentication posture. Which users have MFA? What methods? Is FIDO2 already enabled in your Entra tenant? Any Conditional Access policies that will interact with passkey profiles?
2. Decide your passkey policy. Which user groups get synced passkeys, which get device-bound only, and what hardware keys (if any) do you need for admins?
3. Opt in, don’t drift in. Configure passkey profiles deliberately before Microsoft’s automatic migration applies defaults. The defaults aren’t dangerous, but they may not match your risk appetite.
4. Plan the recovery story. Document device-loss procedures, backup authentication methods, and break-glass accounts stored in a password vault.
5. Roll out with communication. A short video or one-page PDF walking staff through what’s changing beats an email nobody reads.
6. Audit 90 days in. Measure adoption, look at sign-in logs, and tighten Conditional Access where passkey coverage is high enough to phase out weaker methods.

How DVG Systems Helps SMBs Get This Right

DVG Systems is a Thunder Bay-based managed services provider supporting businesses across Northern Ontario — Thunder Bay, Marathon, Geraldton, Timmins, and the surrounding communities. We run Microsoft 365 tenants for clients across sectors — healthcare-adjacent, trades, non-profits, and resource-sector consultants — and we’ve been quietly preparing every one of them for the passwordless transition.

Our approach on passkeys is practical, not preachy. We look at how your team actually works, which applications need to come along, and what a realistic rollout timeline is. We handle the Entra ID configuration, the Conditional Access policies, the hardware key procurement for privileged users, and the end-user training. And because our DVGVoIP division runs business phone systems for many of the same clients, we can tie authentication changes into a broader communications and productivity strategy rather than treating security as a bolted-on afterthought.

If you’re not sure whether your tenant already has FIDO2 enabled, whether your admin accounts are appropriately protected, or what Microsoft is about to change in your environment, our free assessment covers identity, endpoint, backup, email security, and network posture, and you’ll walk away with a plain-English recommendation — not a 40-page PDF full of jargon.

The Bottom Line

The password isn’t dead yet, but it’s on the clock. The NCSC calling time on password-first authentication is a significant marker — not because it changes the laws of physics, but because it changes the default advice consumers and businesses receive. Microsoft’s auto-enablement of passkey profiles does the same thing from the platform side. The two are mutually reinforcing, and the direction of travel is clear.

The businesses that handle this transition well will look much safer from the outside — lower phishing success rates, fewer ransomware precursors, less helpdesk time lost to password resets — while spending less on authentication than they do today. The businesses that drift through it will end up with the Microsoft defaults applied to an environment nobody reviewed, and they’ll find out what that means the first time someone tries to recover a lost passkey at 11pm on a Friday.

We’d rather you be in the first group. Get in touch with DVG Systems or book a free assessment to see where your business stands before the summer migration window closes.

Frequently Asked Questions

Are passkeys actually more secure than a strong password plus MFA?

According to the NCSC’s April 2026 technical report, passkeys are at least as secure — and generally more secure — than pairing the strongest password with two-step verification. The main reason is that passkeys are phishing-resistant by design: there’s no credential for an attacker to capture on a fake login page.

What happens if I lose my phone?

It depends on how your passkeys are configured. Synced passkeys (via iCloud Keychain, Google Password Manager, or a third-party credential manager) are available on your other signed-in devices. Device-bound passkeys are not — you’ll need a backup authentication method, a hardware key, or an administrator-assisted recovery path. This is exactly why recovery planning is part of any proper rollout.

Do passkeys work with Microsoft 365?

Yes. Microsoft Entra ID supports passkeys via the FIDO2 authentication method, and from March 2026 onward (per Message Center MC1221452), passkey profiles are generally available with granular group-based configuration. Microsoft Entra passkeys on Windows reached GA in late April 2026 (Message Center MC1282568).

Do I still need a password manager?

For now, yes. Not every website and application supports passkeys, and until they do, a password manager is still the right tool for the gaps. Over the next three to five years, we expect that list to shrink dramatically.

Does this apply to Canadian businesses?

Yes. While the NCSC announcement is UK-focused, passkeys are built on open FIDO Alliance standards used worldwide. Canadian privacy legislation (PIPEDA) and the Canadian Centre for Cyber Security’s guidance both favour strong, phishing-resistant authentication. Adopting passkeys aligns with both.

Where can I read the original NCSC announcement?

The full press release is on the NCSC website: Leave passwords in the past — passkeys are the future. Microsoft’s own rollout details are tracked in Message Center notices MC1221452 (passkey profile GA + auto-migration) and MC1282568 (Entra passkeys on Windows GA).