Microsoft is turning passkeys on for every Entra ID tenant through 2026. General availability of passkey profiles landed in March. Auto-enablement across tenants that have not opted in is rolling through Q3. For UK SMEs on Microsoft 365, the decision is not whether to move but how quickly to run a controlled rollout before users start hitting passkey prompts without briefing.

This guide walks a UK SME M365 admin through a five-week passkey rollout: what Microsoft has shipped, how to enable passkeys in the Entra admin centre, the Conditional Access policies that make the change painless, the fallback plan when a device is lost, and where passkeys sit inside Cyber Essentials v3.3 in 2026.

What Microsoft rolled out in March 2026

Passkey profiles reached general availability in Microsoft Entra ID in March 2026. Synced passkeys, previously a preview feature, are now supported for standard tenants. Tenants that already had FIDO2 enabled were migrated to the new passkey profiles schema automatically. Tenants that have not opted in are being auto-migrated on a rolling schedule through Q3 2026.

Two changes matter most for UK SME admins. Entra registration campaigns now include passkey nudges, prompting users to enrol during sign-in rather than waiting for a scheduled rollout. Passkey profile size limits were raised to 20 KB, and the maximum profiles per tenant grew from 3 to 10, giving admins more flexibility for role-based configuration.

Why passkeys matter for UK SMEs in 2026

Password plus MFA was the baseline through 2024 and 2025. In 2026, MFA fatigue attacks, session token theft and adversary-in-the-middle phishing have made that combination insufficient on its own. Passkeys, backed by device-bound cryptographic keys, are resistant to every one of those attack patterns.

Two 2026 shifts make the move urgent for UK SMEs specifically. First, Cyber Essentials v3.3 explicitly accepts passkeys and biometric authentication alongside traditional MFA. Second, UK cyber insurers now credit tenants running phishing-resistant identity at renewal, and increasingly ask for evidence at renewal that the SME has begun the migration.

Which devices support passkeys in Microsoft 365 in 2026

Passkey support is now broad across the devices UK SMEs typically run. The gaps that existed in 2024 have mostly closed.

• Windows 11 (22H2 and later): native passkey support in Microsoft Authenticator and Windows Hello for Business.
• Windows 10: supported via Microsoft Authenticator app or a physical FIDO2 security key. Not native to the OS.
• macOS (13 Ventura and later): native passkey support via iCloud Keychain, plus Microsoft Authenticator for enterprise sync.
• iOS 16+ and Android 9+: native passkey support via platform authenticators (Face ID, Touch ID, fingerprint, PIN).
• Hardware security keys: YubiKey 5-series and Feitian keys are the standard for UK SMEs needing FIDO2-certified physical keys, particularly for privileged accounts.

For most 20 to 50-user UK SMEs, the practical mix is Authenticator on the phone for standard users, plus a hardware key for admins and the break-glass account.

The five-week passkey rollout plan

A controlled rollout across a 20 to 50-user UK SME takes about five weeks. The point is to have the entire team enrolled before the auto-enable window hits, not to chase individual users through service tickets afterwards.

1. Week 1: Pilot. Enable passkeys for IT plus one willing team of five to ten users. Test enrolment, sign-in, and the recovery flow.
2. Week 2: Directors and admins. Extend to leadership and any account with admin privileges. This is the group with the highest identity risk exposure.
3. Week 3: Wider staff waves. Roll out to remaining departments in groups of 10 to 20. Send a one-page brief in advance covering enrolment, sign-in and what to do if a device is lost.
4. Week 4: Registration campaign. Turn on the Entra registration campaign for any user who has not enrolled voluntarily. This nudges them at sign-in.
5. Week 5: Decommission legacy. Set passkey-preferred sign-in as the default and phase out SMS and voice-call MFA for standard user accounts. Retain Authenticator app as a fallback method during the transition.

Enabling passkeys in the Entra admin centre

The technical setup is straightforward once you have the pilot group defined.

1. Sign in to Entra admin centre as a Global Administrator or Authentication Policy Administrator.
2. Go to Protection > Authentication methods > Policies. Locate the Passkey (FIDO2) method and enable it for the pilot security group.
3. Configure passkey profiles under the same authentication methods policy. For most UK SMEs, one profile for standard users and one for privileged accounts is enough. You can add up to 10.
4. Enable device attestation for tenants in regulated sectors that need to verify the passkey came from a certified security key manufacturer. This is optional for most SMEs.
5. Turn on the registration campaign under the same policy, scoped to the pilot group. This is what surfaces the enrolment prompt at sign-in.

Conditional Access policies that make passkey rollout painless

Conditional Access is what turns passkeys from an optional method into an enforced one. Four policies get most UK SMEs where they need to be.

• Passkey-required for admin accounts. Global admins, User admins, Authentication admins, Conditional Access admins. No fallback except the break-glass account.
• Passwordless-preferred for M365 apps. Sign-in to Teams, Outlook, SharePoint prompts for passkey first, password only if passkey is unavailable.
• Legacy authentication blocked. IMAP, POP3, SMTP AUTH and other legacy protocols cannot use passkeys, so they should be blocked entirely. If a service account needs legacy auth, isolate it in a scoped exception.
• Location-based fallback removed once enrolled. Trusted-location exceptions were useful during the MFA era. Once passkeys are enrolled, they add risk without benefit.

The fallback plan when a user loses their device

This is the section most UK SME rollouts skip until the first user forgets their laptop at a train station. Get the recovery process documented before that happens.

• Break-glass account per tenant. Two accounts, hardware FIDO2 keys stored in a safe, MFA enforced. These accounts do not sync passkeys and are never used day-to-day.
• Self-service recovery via Authenticator on a secondary device. Most users have a phone and a laptop. Enrol both from day one so losing one does not lock them out.
• Temporary Access Pass (TAP). Entra ID supports issuing a short-lived credential a helpdesk can use to get a locked-out user back in and enrolled on a new device. Rotate TAP validity to 60 minutes.
• Document the recovery playbook once. One page. What the user does, what the helpdesk does, what the audit trail looks like. Update it after the first real recovery incident.

Common mistakes UK SMEs make in passkey rollout

• Enabling for the whole tenant without a pilot. The first user with a bad enrolment experience becomes a change-resistant department. Start small.
• Forgetting service accounts and break-glass accounts. Both need explicit exclusion policies. Both are the accounts you least want to break.
• Skipping the recovery test. Simulate a lost device before the first real one happens. Time the recovery. Fix the slow parts.
• Leaving legacy protocols enabled. IMAP, POP3 and SMTP AUTH cannot enforce passkeys. Any user account still authenticating over legacy protocols is a bypass path.
• Under-communicating. A two-paragraph email is not enough. Send a one-page brief with screenshots two weeks before rollout. Repeat one week before. Repeat the day before.

Where passkeys fit in the Cyber Essentials v3.3 picture

Cyber Essentials v3.3, released by NCSC in April 2026, formally accepts passwordless authentication alongside multi-factor authentication as a valid control. That means passkey adoption directly supports the identity control area of the certification, and reduces the number of MFA-related follow-up questions during assessment. That change aligns with NCSC guidance on phishing-resistant identity, which has been recommending passkeys wherever a service supports them.

Cyber insurers are moving faster than the certification bodies. Several UK insurers now request evidence of passkey adoption rates at renewal, and price the tenant risk accordingly. Documenting the rollout, the enrolment percentage and the Conditional Access policies produces the evidence pack in one pass.

Roll out passkeys before the auto-enable window closes

If you would like a second pair of eyes on your Microsoft 365 setup before the passkey auto-enable window hits your tenant, get in touch and we will walk through your existing authentication methods, where the risk points sit, and what a sensible five-week rollout looks like for your team size.