Passkeys instead of passwords: the practical transition for law firms
Phishing-resistant sign-in without password: what Passkeys are and how the transition in Microsoft 365 works step by step.
Passwords are the weakest link in law firms' IT security. They are forgotten, reused, written on sticky notes, and above all: they can be stolen. Passkeys solve this problem at its root. In this article, we explain what Passkeys are, why they make sense for law firms, and how the transition to Microsoft 365 works in practice.
What is a Passkey anyway?
A Passkey is a digital key stored on your device: on your smartphone, on your Windows computer (via Windows Hello), or on a small USB security key. Instead of typing in a password, you confirm the login with a fingerprint, facial recognition, or device PIN. This sounds like a small convenience gain, but it is technically a fundamental difference.
The decisive point: With a Passkey, the secret never leaves your device. There is no password lying on a server where it could be stolen. And there is nothing you could accidentally enter on a fake website.
Why "phishing-resistant" is more than a buzzword
The most common attacks on law firms today come through deceptively authentic emails: a message appears to be from Microsoft, the link leads to a cloned login page, and anyone who enters their password and even the SMS code there has opened the door to the attackers. Even traditional two-factor authentication via app or SMS only provides limited protection against this, since the second factor can be phished just as easily on the fake page.
A Passkey simply does not work on a fake website. It is technically bound to the genuine address, for example login.microsoftonline.com. The cloned page receives no response, even if the user was deceived. This is exactly why security authorities classify Passkeys as phishing-resistant. For law firms with their confidentiality obligations, this is not a nice-to-have, but currently the most effective single protective measure for access to email and documents.
The transition to Microsoft 365, step by step
1. Check prerequisites. Passkeys are managed in Microsoft Entra ID (the login management behind Microsoft 365) via authentication methods. "Passkey (FIDO2)" is activated there, either for everyone or initially for a pilot group.
2. Start with a pilot group. Two to three people, ideally one from the secretariat, set up their Passkeys and work with them for two weeks. This reveals any obstacles before the entire firm switches over.
3. Set up Passkeys. Each person logs in at mysignins.microsoft.com and adds a Passkey under security information. On the smartphone, the Microsoft Authenticator app handles this, on the Windows PC Windows Hello, alternatively a USB security key. The process takes about five minutes per person.
4. Apply login policies. Once everyone has a Passkey, a policy is set that requires phishing-resistant authentication to access law firm data. This step alone brings the real security benefit, as it renders stolen passwords worthless.
What about older devices?
The justified concern: not every device can handle Passkeys. Older Windows versions without Windows Hello, the aging law firm laptop in the conference room, a staff member's older tablet. There are three practical solutions for this. First: USB security keys work on older computers as long as a current browser is running. Second: The smartphone can serve as a Passkey carrier for the PC; login is then confirmed via QR code and Bluetooth. Third: For devices that won't cooperate at all, login via Authenticator app remains as a temporary option, restricted by policies to what is necessary. It is important to document these exceptions and assign an expiration date, otherwise they remain indefinitely.
Break-Glass: the emergency access
One point that should never be missing amid all the enthusiasm: what happens if the administrator is locked out? For this scenario, every Microsoft 365 environment should have a so-called Break-Glass account: an emergency admin account that is exempt from strict login policies, has a very long and securely stored password, and whose usage is monitored. It is never used in everyday operations, only in emergencies, such as when an erroneous policy locks everyone out. No one should tighten login policies without a Break-Glass account in place.
Conclusion
The transition to Passkeys is manageable for a law firm with reasonable effort: an afternoon of preparation, five minutes per person, two weeks of pilot operation. This comes with a security benefit that no training and no matter how complex password can achieve. Login does not become more cumbersome but faster. There are few IT security measures where comfort and protection increase simultaneously. This is one of them.
Questions? [email protected]