Cyber Security
Introducing passkeys with a registration campaign: your whole team phishing-resistant, without the hassle
We turn on passkeys in Microsoft Entra ID and start a registration campaign: employees are asked to create a passkey when they sign in. That way your whole team is protected against phishing step by step, without everyone having to be helped individually.
The problem
Multi-factor authentication with a code or a notification on the phone is a big step forward, but no longer enough. Clever phishing puts a fake sign-in page between the employee and the real service, and captures both the password and the code. The only thing that really helps then is a way of signing in that cannot be intercepted: the passkey.
Turning on passkeys is the easy part. The hard part is making sure everyone actually creates one. With a registration campaign in Microsoft Entra ID, every employee is asked to create a passkey when they sign in, with a short explanation. We set it up as a project, start with a test group, help anyone who gets stuck and then lock down the most important accounts, so that only a passkey still gives access.
What will you notice?
Your team gets a clear request when signing in and is done in a few minutes. After that, signing in is faster than with a password. You know that a phishing email or a leaked password is no longer enough to get in.
What it does for you
How Introducing passkeys with a registration campaign helps you
- 01
Phishing no longer gets through
A passkey only works on the real sign-in page. Even if someone ends up on a fake page, there is nothing to steal: no password and no code.
- 02
Everyone takes part, automatically
The registration campaign asks every employee to create a passkey when they sign in. No separate instruction emails and no appointments per person; you can see exactly who is already done.
- 03
Faster sign-in
Signing in with a passkey takes one touch of your finger, your face or your PIN. No typing a password and no copying a code.
How it works
How we arrange it
Not a technical story, but what happens and who does what.
Plan an introduction- Step 1
Preparing
We look at how your team signs in now, which devices there are and which type of passkey suits you: in the Authenticator app on the phone, on the laptop, or on a physical security key for administrators.
- Step 2
Turning on passkeys
We turn on passkeys as a sign-in method in Microsoft Entra ID and record which passkeys are allowed. We also arrange a secure way to create a new passkey when someone gets a new phone or laptop.
- Step 3
Starting the registration campaign
We start with a small test group and then the rest of the team. When signing in, everyone is asked to create a passkey, with a short explanation. It can be postponed a few times, after that no longer.
- Step 4
Finishing and locking down
We track who already has a passkey and help anyone who gets stuck. Then we set things up so that administrators and sensitive apps can only be accessed with a passkey, and we phase out weaker methods such as codes by text message.
Frequently asked questions
Questions about Introducing passkeys with a registration campaign
Is your question not listed? Feel free to call us, we are happy to think along with you.
What is a registration campaign?
A setting in Microsoft Entra ID that asks employees, after signing in, to set up a particular sign-in method, in this case a passkey. You decide who gets the request and how often someone may postpone it. That way you introduce passkeys without having to help everyone individually.
What do we need?
Microsoft 365 with Microsoft Entra ID, and for employees a phone with the Authenticator app or a laptop with fingerprint, facial recognition or PIN. To enforce passkeys for administrators and sensitive apps (with Conditional Access), Entra ID P1 is required; that is included in Microsoft 365 Business Premium.
Does MFA need to be turned on already?
It helps, but it is not required. If MFA is not yet turned on, we combine it with setting up secure sign-in with MFA and single sign-on.
What if someone loses their phone?
Then we block the old passkey and the employee can create a new one with a temporary access code. We recommend that everyone has two ways of signing in, for example a passkey on the phone and one on the laptop.
Does a passkey also work for our other apps?
Yes, for all apps that you sign in to with your Microsoft account. For services that do not yet support passkeys, a strong password in the password manager with MFA remains the best choice.
Is this eligible for a subsidy?
Multi-factor authentication is on the list of the NCSC's Mijn Cyberweerbare Zaak subsidy scheme, and a passkey is a strong form of it.
Read more about the Mijn Cyberweerbare Zaak subsidy (in Dutch)