Every other week someone in an SME team types their Microsoft 365 password into a page that looks like login.microsoftonline.com but isn't. A password manager will sometimes catch it, an MFA prompt will delay the attack by a few seconds, but neither will always stop it. Passkeys — the only widely available technology today that eliminates this scenario structurally — because you simply can't type a key into a fake page.
In 2026 passkeys are no longer "the technology of tomorrow". Microsoft, Google, banks, Allegro, Facebook, LinkedIn — every major provider an SME works with day to day supports them. And yet in the Polish SMEs we walk into, maybe 5% of employees actually use a passkey. Below: what it is, why it works, and how to roll it out without locking the bookkeeper out of her account at 4:30 PM on a Friday.
What a passkey actually is
A passkey is a cryptographic key stored on your phone, your laptop, or a physical USB stick (YubiKey, Google Titan). Instead of typing a password, you approve a login with a fingerprint, PIN or Face ID. The key never leaves the device — only a signature proving you have access is sent to the server. It can't be stolen through a password database leak, because there's no password in the database.
Four things worth understanding to strip the "magic" aura off this technology:
- A passkey is bound to a domain. A key registered for
microsoft.comwon't work onmicr0soft-login.pl. Not a matter of good intentions — the protocol simply doesn't allow it. - You can't "read it out over the phone" or paste it into a form. There's nothing to hand to an attacker, no matter how persuasive they are.
- The key is synced across your devices through Apple iCloud Keychain, Google Password Manager, or 1Password/Bitwarden. New phone? Logins reappear on their own.
- MFA disappears as a separate step — a passkey is by itself "something you have" plus "something you are" (biometrics/PIN). No more SMS, no more authenticator app opened every five minutes.
Why this beats password + MFA
Classic MFA (SMS, app code, push) protects against use of a stolen password, but doesn't protect against real-time phishing. An attacker stands up a fake page that looks real to you, you type your login and password, you get a "Is this you?" push on your phone — you tap "yes", because you're logging in. Three seconds later you're logged in — but not at Microsoft, at the attacker, who has already hooked into your session in the background. This scenario is called AiTM (adversary-in-the-middle) and in 2025 it became the standard shape of phishing campaigns targeting companies.
A passkey simply won't work in that scenario. The browser checks that the domain isn't microsoft.com, and the key doesn't get used. You don't have to "not fall for it" — technically you can't fall for it.
Where passkeys already work today
In July 2026 the picture for a typical Polish SME looks like this:
- Microsoft 365 — full support, including Business Basic. Turned on in Entra ID (formerly Azure AD) in about 15 minutes.
- Google Workspace — passkey active on every plan, including Starter. Can be set as a requirement for the whole organisation.
- Banks — mBank, ING, Santander support passkey for business clients. Alior and BNP are piloting. PKO still on SMS.
- Allegro Business, InPost, DHL — passkey available, though often hidden behind "safer login".
- Comarch, enova, Subiekt — no native support. But if you log in via SSO from Microsoft 365, the passkey protects the whole entrance.
What still doesn't work: most Polish B2B wholesale portals, ZUS / e-Tax Office portals (they use qualified signatures instead), older ERP versions running on-premises.
A real example
At one of our clients — an 18-person law firm in Poznań — we logged four phishing campaigns against M365 mailboxes over 12 months. Two of them succeeded: once an assistant typed her password into a page "pretending" to be SharePoint, once a partner clicked a "Teams voicemail" link and approved the MFA push. In both cases the attacker managed to set up an invoice-forwarding rule and send several fake notices to clients before we spotted it in the logs.
The passkey rollout took us three weeks and went like this:
- Week 1 — pilot: six admins and partners registered passkeys on their work phones (iPhone and Android). We bought six YubiKey 5C NFC keys (1,080 PLN total) as emergency backup for a lost-phone scenario.
- Week 2 — the rest of the team: 12 people registered passkeys on their phones. One evening training session (60 minutes), then a 15-minute one-on-one for three people who didn't have biometrics enabled on their phones.
- Week 3 — enforcement: we turned on an Entra ID policy of "passkey or hardware key — required". Passwords still exist, but you can't log in with them from outside. Four people reported "I don't see the prompt" — turned out they were using old Edge; an update fixed it.
Concrete results after six months: zero successful phishing attempts (attempts still come in — four blocked). Onboarding a new lawyer dropped from 40 minutes of "setting up MFA in three apps" to 8 minutes of "register a passkey on your phone". Cost: 1,080 PLN one-off for keys + zero monthly (M365 Business Premium already covers it) + 8 hours of our work for the rollout.
Practical limits nobody mentions
Passkeys aren't a cure-all. Four things worth knowing before Friday 4:30 PM:
- A lost phone = a locked account, if you don't have a second passkey on another device. Every user should have at least two: phone + laptop, or phone + a YubiKey in a drawer at the office. Don't skip this step.
- Not every app supports passkeys. An old in-house app you log into with a local account (not SSO) still needs a password. Passkeys protect the gate, not every room behind it.
- Shared accounts don't play well with passkeys. If your company has a
biuro@mailbox that three people log into with the same password — passkeys won't fix that. It needs to be split into individual accounts with delegated permissions. - Recovery is on you. Microsoft/Google won't get your account back if you lose every device with a key on it. So the admin needs an emergency reset procedure (spare key in a safe, second admin with full permissions).
How to roll it out without chaos
Four principles that make rollouts stick:
- Start with yourself and one admin. Register a passkey on your own account, test logging in from different devices, deliberately try to lock yourself out (put the phone down, sign out on the laptop) and recover access. Before you push it on anyone else.
- Don't force passkeys on day one. For two weeks let people choose: passkey or password + MFA. Anyone who tries it once doesn't want to go back. Then flip the enforcement switch.
- Buy 3–5 YubiKeys as an emergency arsenal. Keep them in a safe. They cost 150–200 PLN each and save the day when someone loses their phone in a taxi.
- Write a one-page "what to do if I lose my phone" procedure. Two phone numbers for the admin, one number, a reset procedure — on a printed sheet, not in a Confluence page you have to log in to read.
Passkey vs MFA vs password manager — what makes sense together
Passkeys don't replace a password manager. You still have systems that don't support passkeys — you need strong, unique passwords there. Password managers are increasingly also "passkey managers" (Bitwarden, 1Password) — one vault, one login.
Passkeys do replace classic MFA on accounts where you turn them on. You don't need SMS and Authenticator and passkey all at once — that's an over-stack that complicates life. One strong authentication works better than three weak ones.
Where to start this month
You don't need a quarterly project. You need one afternoon and a month of soft rollout:
- Check whether your M365 / Google Workspace licence supports passkeys (spoiler: almost certainly).
- Register a passkey on your own account. See how it works. Lock yourself out on purpose and recover.
- Buy 3–5 YubiKeys for the safe as a plan B.
- Announce to the team that for the next month they can enable passkeys — no pressure. Show at one meeting how to do it.
- After a month, enforce passkey or FIDO key for anyone signing in from outside the office.
If you don't know which end to grab first, so you don't lock your team out of email in the middle of a workday — talk to someone who rolls this out in Polish SMEs every week. First conversation is free and takes half an hour.
Passkeys don't protect you because they're modern. They protect you because there's nothing to type into a fake page — and that's the whole revolution.