Somewhere along the way, “going passwordless” picked up a reputation for being expensive, as if every employee needs a little hardware key on their keychain before they can log in. For most small businesses, that’s a myth. A passkey and a hardware security key are two different things, and the version that costs nothing runs on the phones and laptops your team already uses. The platforms you’re paying for, like Microsoft 365 and Google Workspace, already support it. So yes, a small business can give employees passkeys without buying a single security key. Here’s how it works, what it costs, and the cases where a physical key is still worth it.
The confusion is understandable, because the words get mixed up constantly. Once you see the difference between a passkey and a security key, the “do we have to buy hardware?” question mostly answers itself.
Quick Answer
Yes. Your employees can create passkeys on the devices they already own, using Face ID, a fingerprint, or Windows Hello, and those passkeys can sync across their devices through Apple, Google, Microsoft, or a password manager. Business platforms including Microsoft Entra and Google Workspace support these passkeys at no extra hardware cost. Physical security keys are an optional upgrade for shared devices and high-risk roles, not a requirement for going passwordless.
Passkey on a Device vs Hardware Security Key
| Passkey on existing device | Hardware security key | |
|---|---|---|
| What it is | A credential on a phone or laptop | A physical USB or NFC device |
| Hardware cost | None, uses what staff own | Buy one per person |
| Unlocks with | Face, fingerprint, or PIN | Tap or plug in the key |
| Syncs across devices | Yes, if you choose synced | No, tied to the device |
| Best for | Most employees | Shared devices, high-risk roles |
A passkey is not the same as a security key
This is the heart of it. A hardware security key, like a YubiKey, is a physical device you plug in or tap to log in. A passkey is a login credential based on the same underlying standard, but it lives on a device you already have, such as your phone or laptop, and you unlock it with your face, fingerprint, or a device PIN. Both are built on the FIDO standards, and both are phishing-resistant in a way passwords never were. The difference that matters for your budget is simple: a passkey doesn’t require buying anything. You can read the plain-language basics at passkeys.dev if you want the technical grounding.
The two kinds of passkey your staff already have
There are two flavors, and your team can use either. A device-bound passkey is created on one device, using its built-in biometrics, and stays there. A synced passkey does the same thing but replicates across a person’s devices through their Apple, Google, or Microsoft account, or a password manager like 1Password or Bitwarden, so losing one phone doesn’t lock them out. For most small businesses, synced passkeys are the practical choice: an employee sets one up once, and it follows them to their laptop and their new phone without any hardware to carry or replace.
What it costs: close to nothing
Here’s the part that surprises people. If your business runs on Microsoft 365 or Google Workspace, passkey support is already included in what you pay. Microsoft makes passkeys available across Entra ID tiers, including the free one, and you can turn them on and let staff enroll through Microsoft’s passkey setup for Entra. Google Workspace supports passkeys for sign-in as well. The credentials themselves are free because they use hardware your employees already own. The only optional spend is a business password manager, if you want centralized control over synced passkeys, which many small teams find worthwhile but none strictly need to start.
When a hardware security key is still worth it
Physical keys still have a role, but for most logins they aren’t necessary. They earn their cost in specific situations. Shared workstations, like a till, a warehouse terminal, or a front-desk machine where staff don’t sign in with a personal phone, are a natural fit for a key that any authorized person can tap. So are your highest-risk accounts, such as domain admins and finance approvers, where the strongest possible protection is worth the hassle. Some regulated industries also require the level of assurance that only a non-syncing, hardware-bound key provides. Outside those cases, a passkey on an employee’s own device does the job.
How to roll passkeys out to a small team
Keep it simple and phased. Turn passkeys on in your identity platform, then start with the people whose accounts would hurt most if breached: admins, finance, HR, and leadership. Have each person enroll a passkey on their own phone or laptop during a short setup, and confirm they can sign in with it before moving on. Once the first group is comfortable, roll out to everyone else. Keep a documented recovery path for lost devices, and treat offboarding as part of the plan, since you’ll want to remove a departing employee’s access cleanly. A couple of spare hardware keys make good admin backups.
The honest limits to plan around
Passwordless isn’t magic, so go in aware of the trade-offs. A synced passkey is only as secure as the personal cloud account it lives in, so employees using them should have strong protection on their Apple, Google, or Microsoft accounts. Shared devices don’t suit synced passkeys well, which is where hardware keys come back in. You’ll need a real recovery plan for when someone loses a phone, and clear offboarding so credentials leave with the employee. And the strictest compliance levels won’t accept synced credentials at all. None of these are dealbreakers for a typical small business, but they’re worth deciding on before you flip the switch.
What To Know
- A passkey and a hardware security key are different: passkeys run on devices your staff already own.
- Employees can create passkeys with Face ID, a fingerprint, or Windows Hello, at no hardware cost.
- Synced passkeys follow a person across devices through Apple, Google, Microsoft, or a password manager.
- Microsoft Entra and Google Workspace already support passkeys in plans small businesses commonly use.
- Hardware keys are an optional upgrade for shared devices, top-risk roles, and strict compliance.
- Plan for device loss, account recovery, and offboarding before you roll out.
Security needs vary by business and industry, and this is general guidance rather than advice for your specific environment. Confirm current features with your platform provider and, for regulated or high-risk operations, consult a qualified security professional before finalizing your authentication setup.
Frequently Asked Questions
Can a small business use passkeys for employees in 2026 without security keys?
Yes. Employees can create passkeys directly on the phones and laptops they already use, unlocking them with a face scan, fingerprint, or device PIN, and sync them across their devices through Apple, Google, Microsoft, or a password manager. Business platforms like Microsoft Entra and Google Workspace support these passkeys without any hardware purchase. Physical security keys remain an option for shared devices and high-risk roles, but they aren’t required to go passwordless.
What is the difference between a passkey and a security key?
A security key is a physical device, such as a USB or NFC dongle, that you plug in or tap to authenticate. A passkey is a login credential built on the same FIDO standards, but it lives on a device you already own and is unlocked with biometrics or a PIN. Both are phishing-resistant, but a passkey costs nothing extra because it uses existing hardware, while a security key must be purchased for each person.
Are synced passkeys secure enough for business use?
For most small businesses, yes. Synced passkeys are phishing-resistant and far stronger than passwords or one-time codes, which is why they’re considered safe for the majority of enterprise applications. The main caveat is that a synced passkey inherits the security of the personal cloud account it lives in, so those accounts should be well protected. Only the strictest compliance levels, which require non-exportable credentials, rule synced passkeys out.
Does Microsoft 365 or Google Workspace charge extra for passkeys?
No. Microsoft makes passkey support available across Entra ID tiers, including the free edition, so businesses on common Microsoft 365 plans already have it. Google Workspace also supports passkeys for sign-in. Because the credentials use devices employees already own, there’s no per-user hardware cost. The only optional expense is a business password manager if you want centralized management of synced passkeys, which is helpful but not required to begin.
When should a small business buy hardware security keys?
Buy them for specific situations rather than everyone. Shared devices where staff don’t use a personal phone, such as a point-of-sale terminal or a warehouse station, are a strong case, since a physical key works for any authorized user. Your highest-risk accounts, like administrators and finance approvers, benefit from the extra assurance, and some regulated industries require hardware-bound credentials. For the average employee logging in from their own device, a passkey is enough.
What To Do Next
Start small and free. Open your Microsoft 365 or Google Workspace admin settings, confirm passkeys are enabled, and enroll your own admin account first so you know the flow. Then bring in the handful of high-value accounts, get each person set up on their own device, and document a recovery path before widening it to the whole team. Buy a couple of hardware keys only if you have shared machines or roles that genuinely need them. If your team hits any snags at sign-in, our guide to common passkey login problems can help, and the business section has more on running a secure operation.
