How Passkeys Compare With SMS Codes and Authenticator Apps for Small Business Logins

A business login can be protected by a password and a second step. The second step can be a text message code, a code from an authenticator app, or a passkey that replaces the password altogether.

NIST guidance on authentication for government information systems is set out in Special Publication 800-63B-4. The final version is dated July 31, 2025, and it supersedes SP 800-63B. Google and Microsoft now publish setup guides for passkeys in their business accounts.

Three Second Steps and How Passkeys Differ

A password followed by a text message code and a password followed by an authenticator app code both rely on a second secret that the user types in. A passkey is built on the FIDO2 standard and lets the user sign in without entering a username or password.

Microsoft describes two kinds of passkeys. A device-bound passkey keeps its private key on one physical device, such as a FIDO2 security key or Microsoft Authenticator on a phone. A synced passkey is encrypted and stored with a cloud passkey provider, so it can be used on other devices. Microsoft says synced passkeys do not support attestation and should be treated with the same posture as other unattested authenticators.

Google describes its passkeys as combining a first and second factor, so a passkey can replace the password and the second step together.

Date of the NIST Guideline
NIST’s document history lists the final SP 800-63B-4 as dated July 31, 2025, and the abstract says it supersedes SP 800-63B.

What NIST SP 800-63B-4 Says About SMS Codes and Passkeys

Section 3.1.3.3 of NIST SP 800-63B-4 classes PSTN-based out-of-band verification, which covers text messages and voice calls, as restricted. Its use must meet the conditions in section 3.2.9. Section 3.1.3.1 limits SMS and voice delivery to cases where the verifier supplies the secret and the device is identified by a SIM or equivalent. Verifiers should remind subscribers of coverage limits and should consider risk indicators such as a SIM change or number porting.

The same section requires that verifiers SHALL ensure alternative authenticator types are available to all subscribers. NIST also says it may adjust the restricted status of PSTN out-of-band authentication.

On phishing resistance, section 2.2.2 requires that a verifier SHALL offer at least one phishing-resistant option at AAL2. At AAL3, section 2.3.2 requires an authenticator that provides phishing resistance and holds a non-exportable private key. Section 2.3.2 also says syncable authenticators SHALL NOT be used at AAL3, because they need an exportable key. Their requirements appear in section 3.1.7.4 and Appendix B.

Read with Microsoft’s description, a synced passkey may fall within the syncable category, in which case it cannot be used where AAL3 applies. Rules for one-time codes from authenticator apps are not covered here and should be checked in the guideline’s one-time password sections before a policy is written.

Which Business Tools Support Passkeys Today

Google’s admin guidance says that when an admin enables skip password on a user’s account, users can sign in to a managed Google Workspace account with a passkey, using a phone, a security key or the computer’s screen lock. Some Workspace accounts may not allow passkey-only sign-in. Google’s account help page says a passkey can be created on the current device or on a hardware security key, that Apple devices need iCloud Keychain turned on, and that a new passkey may need to wait seven days before it is available at sign-in. The minimum browser versions listed are Chrome 109, Safari 16, Edge 109 and Firefox 122.

Microsoft Entra ID supports passkeys in every edition, including the free tier, with no extra licences. Users can register synced passkeys, and device-bound passkeys stored on FIDO2 security keys or in Microsoft Authenticator. An Authentication Policy Administrator turns the method on under Entra ID, Security, Authentication methods, Policies, then Passkey (FIDO2). On the Configure tab, Allow self-service set up must be set to Yes, or users cannot register through Security info. Guest users cannot register passkeys. Microsoft’s page was last updated May 15, 2026.

Microsoft’s table of synced-passkey providers lists Apple Passwords, Google Password Manager, and third-party managers such as 1Password and Bitwarden. Apple Passwords is built into macOS 13 and later and iOS 16 and later. Google Password Manager is built into Android 9 and later, excluding Samsung devices. Other providers need a browser extension on desktop or an app on iOS 17 and later or Android 14 and later.

NIST classes text-message codes as restricted, and applications assessed at AAL2 must offer a phishing-resistant option.

A Rollout Plan for a Team Without an IT Department

Start with the accounts that carry the most risk, such as administrators, finance staff and anyone who can approve payments. Microsoft’s example profiles require device-bound passkeys with attestation for IT admins, executives and engineering, and allow synced or device-bound passkeys for groups such as HR and sales.

Choose the passkey tools before switching anything on. A password manager with synced passkeys suits general staff. A hardware FIDO2 security key suits the most sensitive accounts, and Google’s help page lists hardware security keys as a supported option.

Turn the feature on in the admin console. In Google Workspace, the admin must allow passkey sign-in on the user’s account. In Entra ID, follow the Authentication methods steps above and set self-service to Yes. Test with a small pilot group before opening it to everyone.

Each user then creates the passkey from their own account security settings. Microsoft requires the user to have completed multifactor authentication within the past five minutes before registering. Google’s help page describes creating passkeys on more than one device or on a security key, and notes that adding a passkey does not change or remove existing sign-in factors.

Keep SMS as a fallback only where NIST’s conditions can be met. Because section 3.1.3.3 requires that alternative authenticator types stay available to subscribers, a team should not remove other sign-in options until every person has a working passkey and a second method.

Recovery Steps for Lost Devices and Changed Accounts

If a device is lost or stolen, Google’s help page says to sign in from another device and remove its passkey, and to check any third-party credential manager the user has. If Google flags a passkey as suspicious, the passkey is disabled, and the user has 30 days to confirm it before it is deleted.

In Microsoft Entra ID, a passkey cannot be modified after a user’s UPN changes. The user must sign in to Security info, delete the old passkey and add a new one. Microsoft notes that registration is not supported for internal or external guest users.