Passkeys for a Small Office: Rollout and Lost-Phone Recovery Runbook

By Justin N. · Published 2026-10-25 · This page may contain affiliate links

A passkey is the sign-in method Microsoft now pushes hardest: nothing to type, nothing to phish. The catch for a small office is the day someone loses the phone their passkey lives on. Here's how to turn passkeys on in Microsoft Entra ID, what to set up before anyone needs it, and a one-page runbook for getting someone back in after a lost or stolen phone.

Licensing check: Microsoft says passkeys "are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free. No extra licenses are required" (Enable passkeys (FIDO2)). So Business Standard and Business Premium can both use them. Two parts of this guide need Entra ID P1, which Business Premium includes and Business Standard doesn't: requiring passkeys at sign-in (Conditional Access), and the Temporary Access Pass used for recovery. Both are marked below. Facts are from Microsoft Learn, checked on 2026-10-25.

Which passkeys to use

Microsoft Entra ID supports two kinds of passkey (Enable passkeys (FIDO2)):

Device-bound passkeys. The private key is created on one device and never leaves it. Microsoft's examples are Microsoft Authenticator on iPhone or Android, and a FIDO2 security key (a small USB or NFC key).
Synced passkeys, stored in a provider such as Apple iCloud Keychain or Google Password Manager and usable on the user's other devices. Microsoft says synced passkeys don't support attestation, and to treat them as phishing-resistant but with the same security posture as other unattested authenticators.

For a small office I'd start with passkeys in Microsoft Authenticator for everyone, because staff already have the app, and add a security key for admins and anyone who wants a backup. Authenticator passkeys need Android 14 or later, or iOS 17 or later (Enable passkeys in Authenticator).

The trade-off is the reason this guide exists: a device-bound passkey on a phone is gone when the phone is. Plan the recovery before you roll out.

Turn on passkeys (Authentication methods policy)

You need at least the Authentication Policy Administrator role. These steps follow Microsoft's passkey and Authenticator passkey articles.

In the Entra admin center (entra.microsoft.com), go to Entra ID > Authentication methods > Policies and select Passkey (FIDO2).
If you see a banner about passkey profiles, opt in. Microsoft says your existing settings move to a Default passkey profile, and that you can't opt out afterward.
On the Configure tab, set Allow self-service set up to Yes. If it's No, users can't register a passkey from Security info.
Select + Add profile and name it something like Authenticator passkeys. Set Passkey types to Device-bound, turn on Target specific AAGUIDs with Behavior set to Allow, and add Microsoft Authenticator. Microsoft lists the Authenticator AAGUIDs as de1e552d-db1d-4423-a619-566b625cdc84 (Android) and 90a3ccdf-635c-4729-a248-9b709135078f (iOS) if you add them by hand. If you also want security keys, keep the Default profile allowing them, or add their AAGUIDs.
On Enable and Target, set Enable to On, add a pilot group first (later All users), pick the profile, and save.

Careful with AAGUID lists: Microsoft warns that if you remove an AAGUID you previously allowed, users who registered that kind of passkey can no longer sign in with it. Also, a user in a group that's excluded from the Passkey (FIDO2) policy is blocked from passkeys entirely, even if another group includes them.

Then nudge people to register. The registration campaign (Entra ID > Authentication methods > Registration campaign) prompts users to set up a passkey after they complete MFA at sign-in. Microsoft's prerequisites for a passkey campaign are that the Passkey (FIDO2) method is enabled with self-service setup allowed, and that targeted users are in scope for it (Registration campaign). Users can also register in the Authenticator app itself, which Microsoft calls the recommended way, or from Security info (Register a passkey in Authenticator). Security keys are registered from Security info (Register a passkey with a security key).

Before anyone loses a phone

Do these once, while nothing is on fire:

Give everyone two methods. If the lost phone held someone's only method, they can't sign in to fix it themselves. A security key kept at home or in a desk drawer is the cleanest second method. If you don't buy keys, Authenticator push on a second device is better than nothing.
Decide who can help. Users can't fix a lost-only-method problem themselves, so name one or two people. In Entra, an Authentication Administrator can manage methods, revoke sessions and create a Temporary Access Pass for regular users. Doing the same for another admin takes a Privileged Authentication Administrator (Temporary Access Pass). In a small office that's often the owner plus the outside IT person.
Write down an identity-check rule and stick to it. For example: a video call where you can see the person, or in person. Never act on an email or chat message alone. A "lost my phone, please reset me" request is exactly what an attacker would send.
On Business Premium, turn on the Temporary Access Pass now (see below), so it's ready when you need it.
Print the runbook and fill in the blanks.

Break-glass accounts

If the only admin is the one who lost their phone, you need a way back into the tenant. That's what emergency access ("break-glass") accounts are for. Microsoft's guidance (Manage emergency access accounts):

Create two or more cloud-only accounts on the *.onmicrosoft.com domain, not federated or synced from on-premises, with the Global Administrator role.
Give them a passwordless method: Microsoft recommends a passkey (FIDO2), or certificate-based authentication if you already run a PKI. For a small office, that means a security key for each account, stored in separate secure places.
Make sure the accounts aren't registered for MFA or self-service password reset on any one person's phone or personal details.
Exclude them from Conditional Access policies that block or restrict sign-in (Business Premium).
Test that they can sign in and do admin work at least every 90 days, and review who's allowed to use them. Microsoft also recommends alerting on every sign-in by these accounts. Its example uses Azure Monitor alerts on the sign-in logs. At a minimum, check those sign-ins as part of your 90-day test.

Microsoft says these methods satisfy its mandatory MFA for admin portals, which applies to break-glass accounts too (Mandatory MFA). More on setting these up is in Conditional Access starter policies.

Phone lost or stolen: the first 15 minutes

Whoever handles it signs in to the Entra admin center as at least an Authentication Administrator, then:

Verify who's asking, using your identity-check rule.
Delete the lost phone's methods. Go to Entra ID > Users, select the user, then Authentication methods. Delete the passkey that lived on the lost phone (Microsoft's steps: open the passkey's menu and select Delete) and the Microsoft Authenticator entry for that phone (Delete a passkey, Manage user authentication methods).
Revoke sessions. On the same page, Revoke sessions invalidates the user's refresh tokens, forcing them to sign in again across active sessions and apps (Manage user authentication methods). With the phone's methods deleted, whoever has the phone can't complete that sign-in.
Reset the password if there's any chance it's known, for example if the phone was unlocked or the password was saved on it. Reset password is on the same page. That's my rule of thumb, not a Microsoft requirement.
Deal with the device itself, if it's managed by Intune. A company-owned phone can be wiped. Microsoft lists "securely erased if lost or stolen" as a use of the Wipe action (Wipe devices). For a personal phone with Intune app protection, remove only the work data with a selective wipe (Wipe corporate data from apps). That setup is in Intune app protection for BYOD phones.

Getting the user back in

Business Premium: a Temporary Access Pass

A Temporary Access Pass (TAP) is a time-limited passcode. Microsoft says it "makes recovery easier when a user loses or forgets a strong authentication method", and a user can sign in to Authenticator with one to register a passkey (Temporary Access Pass). Microsoft lists TAP as an Entra ID P1 feature (Configure Microsoft Entra for increased security, TAP deployment guide).

Turn it on once: as an Authentication Policy Administrator, go to Entra ID > Authentication methods > Policies > Temporary Access Pass, enable it, and include the users who may need it. Only users included in the policy can sign in with a TAP. Microsoft's defaults are a 1-hour default lifetime, an 8-hour maximum, and one-time use set to No. Lifetimes can range from 10 minutes to 30 days. I'd set one-time use to Yes in the policy, which Microsoft says makes every pass in the tenant one-time use.

Issue one when needed:

Go to Entra ID > Users, select the user, then Authentication methods > Add authentication method > Temporary Access Pass. Keep the lifetime short, such as the 1-hour default.
Copy the code straight away. Microsoft says you can't view it again after you select OK.
Give it to the user over a different channel from the one the request came in on, for example by reading it out on the video call.

Two things to know. With a one-time TAP, the user has to finish registering the new passkey within 10 minutes of signing in. And a TAP expiring doesn't end sessions the user already started with it. Microsoft says to use a Conditional Access sign-in frequency setting to limit how long that access lasts.

Business Standard: second method, or re-register

Without Entra ID P1 you don't have the TAP, so recovery depends on what the user has left:

They have a second method (a security key, or Authenticator on another device): they sign in with it and register the new phone themselves.
The lost phone was their only method: on the user's Authentication methods page, an Authentication Administrator can choose Require re-register MFA. Microsoft says this deletes the user's phone numbers, Microsoft Authenticator apps and software OATH tokens, and the user is asked to set up a new MFA method the next time they sign in (Manage user authentication methods). Delete the lost passkey separately, as in the step above. Until they re-register, the account is protected only by its password, so do this while you're on the call with the user and have them sign in straight away.

Entra ID P1 is also sold on its own (Microsoft Entra licensing) if you want TAP without moving everyone to Business Premium.

Re-registering on the new phone

Install Microsoft Authenticator on the new phone.
Tap Add work or school account > Sign in, then sign in with the TAP (or the second method).
Follow the prompts to create the passkey. On iPhone, Authenticator asks you to turn it on as a passkey provider: on iOS 18 it's Settings > General > Autofill & Passwords, and on iOS 17 it's Settings > Passwords > Password Options (Register a passkey in Authenticator).
Open Security info and check that the new passkey is listed and the old phone's methods are gone. Microsoft says users who update their methods after losing a device "should make sure they remove the old authentication methods." If a TAP is still listed, the user can delete it there too (Temporary Access Pass).

Conditional Access can block this step (Business Premium). Microsoft documents two common traps (Enable passkeys in Authenticator):

A policy that requires phishing-resistant authentication for All resources can put users in a loop when they try to add a passkey in Authenticator. Microsoft's workaround allows a TAP on mobile platforms for registration.
A policy that requires an approved client app or app protection policy for All resources stops users registering passkeys in Authenticator, because Authenticator doesn't support that control. That's the usual setup for personal phones. Microsoft's options are to target specific apps instead of All resources, to allow a compliant (Intune-enrolled) device as an alternative, or to give the user a short, temporary exclusion and remove it afterward.

Users also have to satisfy any policy on registering security info.

Self-service vs help desk

Task	Who does it	Where
Add a new passkey while another method still works	User	Authenticator app or Security info
Delete an old method	User, or the help desk	Security info, or the user's Authentication methods page
The lost phone was the only method	Help desk	TAP (Business Premium) or Require re-register MFA
Revoke sessions, reset password	Help desk (Authentication Administrator)	User's Authentication methods page
Wipe a company phone, or work data on a personal phone	Help desk (Intune)	Intune admin center

Self-service password reset (SSPR) doesn't cover this. Microsoft's methods table shows passkeys can't be used for SSPR or account recovery, and SSPR resets a password rather than replacing a lost passkey (Authentication overview, How SSPR works).

What Business Standard can enforce

Business Standard comes with Entra ID Free (Microsoft Entra licensing), so your baseline is security defaults. Microsoft lists what they do: require all users to register for MFA, require MFA for administrators and for users when necessary, block legacy authentication and device code flow, and protect privileged activities like access to the Azure portal. Security-defaults users register Microsoft Authenticator notifications (Security defaults).

You can enable passkeys, target them to groups and run a registration campaign. Microsoft warns not to disable authentication methods while you use security defaults, because it can lock you out (same article).
You can't require passkeys or phishing-resistant MFA at sign-in. That takes Conditional Access authentication strengths, which need Entra ID P1 (Authentication strengths). Users with a passkey can use it, but nothing stops them using Authenticator push instead.
You don't have the Temporary Access Pass (see above).

My take: on Business Standard, passkeys are still worth turning on for admins and anyone willing, with security keys for the admins. Just plan recovery around second methods.

What Business Premium adds

Business Premium includes Entra ID P1 (Microsoft Entra licensing), which adds:

Authentication strengths in Conditional Access. Microsoft's way to make users sign in with a passkey is a Conditional Access policy with the built-in Phishing-resistant MFA strength or a custom one (Enable passkeys (FIDO2), Authentication strengths). Start with admins, as in CA02 of the starter policies, then widen to everyone once registrations are high. Build in report-only mode first, and exclude the break-glass accounts.
The Temporary Access Pass for recovery and first-time setup.
Sign-in frequency to cap how long a TAP sign-in lasts (Session lifetime).
Device compliance through Intune, which Microsoft lists as one way around the app-protection registration block above.

Printable one-page runbook

Fill in the blanks and keep a copy with your admin notes, somewhere you can reach without signing in.

Lost or stolen phone: passkey recovery runbook

Help desk contact: ____________________ · Phone: ____________________
Who can issue a TAP or reset methods: ____________________ · Backup: ____________________
Our identity-check rule: ________________________________________

1. First 15 minutes

Confirm who's asking, using the identity-check rule above. Never act on email or chat alone.
Entra admin center > Entra ID > Users > [user] > Authentication methods: delete the lost phone's passkey and its Microsoft Authenticator entry.
Same page: Revoke sessions.
Same page: Reset password if the phone was unlocked or the password might be known.
Company phone: wipe it in Intune. Personal phone: selective wipe of work data.

2. Get them back in

Business Premium: Add authentication method > Temporary Access Pass, with a short lifetime. Copy the code now, because it won't show again.
Give the code over a different channel than the request, such as reading it out on the call.
Business Standard: user signs in with their second method. If they have none, choose Require re-register MFA and have them sign in right away, while you're still on the call.

3. Re-register (user)

Install Microsoft Authenticator > Add work or school account > Sign in with the TAP or second method.
Create the passkey within 10 minutes if using a one-time TAP. On iPhone, allow Authenticator as a passkey provider when asked.
Check mysignins.microsoft.com/security-info: new passkey listed, old phone gone, TAP deleted.

4. Afterward

Was the lost phone an admin's only method? Test both break-glass accounts this week.
Make sure the user now has two methods. Note the date and who handled it: ____________________

Sources

Accuracy note: Microsoft changes admin center menus and licensing often. Paths and prices were checked against Microsoft documentation on 2026-10-25. If something has moved, tell me at [email protected].