Since spring/summer 2026, Microsoft has been rolling out "passwordless by default" to existing Business Premium tenants in stages. Apple, Google, and Microsoft now jointly back the FIDO2 standard. The message is unambiguous: the classic password is on its way out — even if the road there is bumpier than the marketing slides suggest.

Why Passwords Remain the Problem

Stolen credentials have been the single most common cause of data breaches for years — and that hasn't changed in 2026. Passkeys work on a fundamentally different technical principle: instead of a secret that gets typed in and can be intercepted, the device generates a cryptographic key pair. The private key never leaves the device; only the public key is stored with the service. At login, the device cryptographically proves it holds the private key — without ever transmitting a password that could be captured.

The Real Advantage: Phishing Resistance

The decisive security gain isn't convenience — it's structural phishing resistance. A fake login page can capture a password. It cannot steal a private key that never leaves the device. That doesn't just close one of the most common attack vectors; it removes it structurally.

Why the Rollout Is Still Bumpy

A recent survey of 2,000 security professionals found that 90% report concrete problems implementing passwordless solutions. The obstacles lie less in the principle and more in execution — complex enterprise environments with legacy systems, mixed operating systems, and specialized access requirements complicate a clean rollout.

Adopting passwordless authentication isn't a standalone tech project — it's part of a continuous security evolution, comparable to the gradual rollout of MFA and Zero Trust.

How a Rollout Actually Succeeds

A structured, phased approach has proven effective in practice:

  • Inventory of all authentication methods currently in use
  • Configuration of appropriate conditional access policies
  • Pilot phase with a small, tech-savvy user group
  • Phased rollout across multiple waves instead of a "big bang"
  • Optional, later deactivation of classic passwords after a transition period

Important caveat: not every passwordless solution is equally secure — the same lesson that applied to MFA (SMS codes are weaker than authenticator apps or hardware keys) applies here too.

Conclusion

Passkeys are no longer a future topic in 2026 — major platform providers are actively making them the default. Moving early, but in a structured way, pays off for companies — not for the sake of modernity, but because it's one of the most effective available defenses against phishing and credential theft.