Home / Insights
Article

Passkeys passed the tipping point. Now comes the hard part.

Billions of passkeys exist and most consumers know what they are. The remaining work sits inside enterprises still relying on phishable sign-in.

September 22, 2026Indigo Consulting5 min readAuthentication

The FIDO Alliance estimates that 5 billion passkeys are now in use. 90% of consumers are aware of them, 75% have enabled a passkey on at least one account, and 49% use them regularly.1

98%

of passkey sign-ins succeed, compared with 32% for passwords, according to Microsoft. Passkeys are also eight times faster than a password plus MFA.2

The enterprise gap

Consumer adoption has raced ahead. Inside organizations, 68% have deployed or are deploying passkeys for employees, yet 57% still rely on phishable methods for daily sign-in.1 That gap is where attackers live.

Platform vendors are closing it for you. Microsoft Entra makes passkeys the default authentication experience from September 1, 2026, and retires Microsoft-provided SMS and voice MFA on February 1, 2027.3 If your workforce still depends on text message codes, the timeline is now set externally.

The operational payoff

Organizations that deployed passkeys report 35% fewer password reset tickets.1 That is the business case many security teams have been missing: lower support cost alongside lower risk.

Where projects stall

  • Recovery. A passkey rollout is only as strong as the account recovery path behind it.
  • Legacy applications. Older apps that cannot speak modern federation need a gateway or modernization plan.
  • Shared and frontline devices. Kiosks, call centers and retail floors need their own patterns.
  • Customer messaging. Adoption follows design. Offer passkeys at the moment of success, right after a sign-in.

Sources

  1. FIDO Alliance, World Passkey Day 2026
  2. Microsoft Security Blog, Pushing passkeys forward (May 2025)
  3. Microsoft Learn, SMS and voice retirement in Microsoft Entra

Related insights

Explainer

NIST SP 800-63-4 in five changes

The updated US digital identity guidelines rewrite long-held password rules and raise the bar on phishing resistance. A short guide for architects.
Chart of the Week

Machine identities outnumber people 109 to 1

Service accounts, workloads, API keys and now AI agents vastly outnumber the people in your directory. Most governance programs were built for the minority.
Article

Agentic AI needs an identity strategy before it needs a model strategy

AI agents act on behalf of people and systems. Who they are, what they may touch and how they are audited are identity questions first.

Ready to make your next identity move?

Talk to our team