Setting up a passkey for your work account

What is a passkey, and why do I need it?

A passkey replaces your password and your authentication code with your device. You unlock your phone or laptop the way you already do — face, fingerprint or PIN — and that unlocks your work account.

Your fingerprint or face scan never leaves your device. It isn't sent to Microsoft, and Iris 365 never sees it. The device simply confirms it's you, then proves to Microsoft that it holds the right key.

It can't be phished

A passkey only works on the real Microsoft sign-in page. If you land on a convincing fake, the passkey won't respond — there is nothing for you to type in and nothing an attacker can talk you into approving.

Nothing to remember, nothing to wait for

No password to type, no code to read off your phone, no notification to approve. Sign-in takes a couple of seconds.

It can't be reused against you

The key is tied to your device and to Microsoft's sign-in page. Even if someone captured it, it would be useless anywhere else.

Before you start

You'll need:

• Your work laptop or PC, or your phone with the Microsoft Authenticator app installed.
• Your device unlock already set up — Windows Hello (face, fingerprint or PIN) on a laptop, or Face ID, Touch ID or a passcode on a phone.
• About ten minutes.

You can set up a passkey on your computer, on your phone, or on both. Two passkeys is the better option: if you lose or replace one device you can still get in with the other. Follow whichever section applies, then come back and do the second one.

Setting up on your Windows computer

1. Sign in and look for the prompt

   Next time you sign in to a Microsoft 365 app or website, you'll see a screen headed Let's keep your account secure. Choose Next to begin.

   If you genuinely can't do it right now, Not now will postpone it. You can postpone for up to five days, after which the setup has to be completed before you can continue.

   

2. Start creating the passkey

   You'll see Sign in faster with your face, fingerprint, or PIN. Choose Next.

   

3. Save the passkey to your computer

   A Windows Security box appears showing your email address and confirming the passkey will be saved to your Windows device. Choose Continue.

   

   The wording varies slightly between browsers. If your box asks Use your device to sign in to login.microsoft.com? instead, that's the same step — choose OK.

   

4. Confirm it's you

   Windows asks you to look at the camera, touch the fingerprint reader, or enter your Windows PIN. Do whichever it asks for. That's the passkey created.

   If you're asked to give the passkey a name, use something you'll recognise later, such as Work laptop.

Setting up on your phone

These screens come from an iPhone. Android looks slightly different but the steps are the same. You'll need the Microsoft Authenticator app installed and signed in to your work account.

1. Start the setup

   When the prompt appears on your phone, you'll see Sign in faster with your face, fingerprint, or PIN. Tap Next.

   

2. Let the security window open

   Your phone tells you it's opening a security window. Tap Next and follow whatever your phone asks — usually Face ID, a fingerprint or your passcode.

   

3. Name the passkey

   Give it a name you'll recognise if you ever need to check your sign-in methods — My iPhone or Work phone is fine. Tap Next.

   

4. Finish

   Passkey created means you're done. Tap Done.

   

Signing in from now on

At the Microsoft sign-in screen, enter your email address as usual. Instead of asking for a password, it will offer to sign you in with your passkey. Unlock your device and you're in.

If you set the passkey up on your phone but you're signing in on a computer, you may be shown a QR code. Scan it with your phone camera, confirm on the phone, and the computer signs in.

You'll still see a password prompt occasionally — on older applications, for example. Your password still works; the passkey is simply the better route in.

Common questions