If you run a growing business, you’ve probably had this moment: someone can’t sign in, they’re stuck in an MFA loop, and it’s suddenly everyone’s problem. You want stronger security, but you also want Monday morning logins to be boring.

Passkeys are getting a lot of attention because they can be both: more secure and easier for your team. Microsoft is also pushing in that direction inside Entra ID, and NIST keeps pointing organisations toward “phishing-resistant” sign-in.

The real question you’re trying to answer

Most leaders ask, “Should we use passkeys or an authenticator app?” What you usually mean is: “What reduces account takeovers without turning sign-in into a helpdesk ticket generator?”

A good comparison has to look at two things:

  • How often it stops the common attack. For most businesses, that is still credential theft through phishing.
  • How it fails on a normal workday. New phone, lost phone, travel, a laptop replacement, or a new hire on day one.

Passkeys (FIDO2/WebAuthn): the default direction

A passkey is a sign-in method that uses cryptography instead of a shared secret you can type into a fake website. Practically, it looks like Face ID, Touch ID, a device PIN, or Windows Hello, then you’re in.

Why businesses like them once they’re set up: fewer prompts, fewer “approve this sign-in?” popups, fewer users trained to click “Yes” to make the box go away.

Here’s what to know in plain English:

  • Phishing-resistant by design. A passkey is tied to the real site or service you’re signing into. If someone tricks your employee into visiting a lookalike login page, the passkey doesn’t quietly hand over a reusable code.
  • Works well with Microsoft Entra ID. Microsoft is actively making passkeys the default sign-in experience in Entra ID, and supports passkeys stored in Microsoft Authenticator, on Windows (Entra passkey on Windows), and on FIDO2 security keys.
  • The gotcha is lifecycle. You need a clean way to handle “new phone”, “lost phone”, and “new laptop”. If you don’t plan that part, passkeys feel great right up until the first person gets locked out.

Authenticator push (with number matching): still useful, but easier to trick

Authenticator push is the familiar “approve sign-in” prompt on a phone. It’s better than SMS, and for many businesses it’s the first MFA method that actually sticks.

The biggest risk with basic push is that humans are human. If somebody is tired, distracted, or being pressured by a convincing phishing page, they can approve a prompt they didn’t start.

Number matching improves this by forcing the user to type a number shown on the sign-in screen into the app. That extra step breaks a lot of “MFA fatigue” style attacks.

In practical terms:

  • Good step-up security. Push with number matching is a meaningful improvement over simple “Approve/Deny”. CISA specifically recommends number matching to reduce push-based MFA abuse.
  • Not the end state. It still depends on the user making the right choice at the right time. NIST’s direction is clear that phishing-resistant authentication is the goal for higher assurance.
  • Great as a bridge. For many 25 to 250 person companies, number-matching push is a solid baseline while you roll out passkeys and hardware keys where they matter most.

Hardware security keys: the “spare key” your business will be glad you bought

A hardware security key (often called a FIDO2 key) is a small device, usually USB or NFC, that you tap or insert to sign in. It’s still a passkey experience, just stored on a dedicated key instead of a phone or laptop.

They tend to shine in two places:

  • Privileged users. Admin accounts, finance leaders, and anyone who can approve payments or change security settings.
  • Account recovery and edge cases. If someone loses their phone while travelling, a pre-issued hardware key can save you from a messy scramble.

Things to plan for:

  • Inventory and assignment. Treat keys like company assets, not personal gadgets.
  • Spare coverage. Keep a small pool of sealed spares for emergencies, and document who can issue them.

A simple way to compare them

Instead of getting lost in features, compare them by what they’re good at.

  • Passkeys. Best for phishing resistance and daily usability, once lifecycle is planned.
  • Authenticator push (number matching). Good baseline MFA, widely compatible, but still more “human-dependent” than passkeys.
  • Hardware keys. Excellent for high-risk roles and as a recovery backstop, with some operational overhead.

A staged adoption path for a 25 to 250 person business

You don’t need a big-bang switch. You need a sequence that reduces risk early, then improves the user experience.

Stage 1 (Weeks 1 to 3): stop the easy wins

  • Pick your baseline MFA method. If you are using Microsoft Authenticator push, make sure number matching is enabled.
  • Separate admin accounts. Make sure admins have dedicated admin accounts (not “daily driver” accounts) and stronger sign-in requirements.
  • Define account recovery. Decide, in writing, how you will handle lost phones and new devices (who verifies identity, how long it takes, what’s required).

Stage 2 (Weeks 4 to 8): roll out passkeys to the people who feel the pain first

  • Start with IT and leadership. These users are easiest to support closely, and they’re the accounts you least want phished.
  • Pilot on company-managed devices. Passkeys tied to managed endpoints (for example Windows Hello for Business) tend to be smoother operationally.
  • Use Conditional Access intentionally. Microsoft’s Authentication Strengths let you require phishing-resistant methods for specific apps or groups without forcing every user to change overnight.

Stage 3 (Months 3 to 6): make phishing-resistant sign-in the normal path

  • Expand passkeys to most staff. Prioritise roles that handle money, customer data, or sensitive inboxes.
  • Issue hardware keys where it makes sense. Admins, finance, and a few “always travelling” users are common picks.
  • Reduce reliance on phishable methods. As passkeys coverage grows, tighten policies so high-value systems require phishing-resistant authentication.

Stage 4 (Ongoing): keep it from drifting

  • Watch sign-in logs and helpdesk trends. If you see repeated MFA prompts, weird sign-in locations, or frequent lockouts, adjust policies and training.
  • Make onboarding repeatable. New hires should register the right methods on day one, with a clear checklist.
  • Test recovery quarterly. Pick one volunteer per quarter and run the “lost phone” process end to end. If it’s clunky, fix it before it’s urgent.

What we recommend most often

For most growing businesses, the practical target looks like this:

  • Most users: passkeys as the primary experience, with a sensible backup method for recovery.
  • Admins and finance: phishing-resistant methods required (passkeys and/or hardware keys), with tighter Conditional Access.
  • Everyone: fewer prompts, fewer “approve this” habits, and a recovery process that is documented and calm.

If you would like help choosing the right mix of passkeys, authenticator settings, Conditional Access, and recovery processes for your Microsoft 365 tenant, the Flexnet Networks team can map out a staged rollout that fits how your business actually works.

Sources