Passwordless working: can your SME start today?

Nov 12, 2025 (updated on Nov 09, 2026)

In conversations with SME owners, one question keeps coming back: can we just get rid of passwords? The short answer is yes. The longer, more honest answer: the technology is usually already inside the licences you pay for today, but the switch takes preparation. In this article: why passwords are the problem, what Windows Hello for Business and passkeys actually do, what you need and where to start.

Passwords are the problem, not your people

"Password? It's 2025 and people are still typing passwords... What are we doing?" That reaction from a security podcast stuck with me, and rightly so. Passwords get forgotten, reused, leaked and phished. As long as a human has to type a password somewhere, an attacker can steal it.

Multi-factor authentication dampens that risk, but MFA is a threshold, not a wall either: session tokens can be hijacked, as we explain in our article on token spraying. If you want to lower the risk for real, you eventually move to passwordless sign-in. The human types nothing, so there is nothing to phish.

Windows Hello for Business: the key you usually already have

Many SMEs already have passwordless sign-in available without realising it. Windows Hello for Business is built into Windows 10 and 11 and lets users sign in with their face, fingerprint or a PIN. No password travels to a server anymore; the sign-in runs on a cryptographic key that stays on the device itself.

With facial recognition, an infrared camera builds a 3D model of your face. From that, Windows calculates a mathematical template that is stored encrypted and locally on the device. Your biometrics never leave the device, not even towards Microsoft. That has two consequences that matter to an employer: sensitive biometrics of your employees do not sit on a central server, and nobody can reconstruct your face or fingerprint from a stolen laptop.

Signing in is faster than typing and carries less risk: you do not hand over your finger or face the way you hand over a password. Good biometrics rarely lets someone else through; Apple quotes a false acceptance rate of 1 in 1,000,000 for Face ID. If biometrics fails once, the PIN is always there as a back-up. That PIN is tied to one specific device and works nowhere else, which makes it fundamentally different from a reusable password.

Passkeys: a key instead of a secret

The next step is passkeys, built on the FIDO2 standard that Microsoft, Apple and Google all support. A passkey is a cryptographic key pair: the private key stays in your device or in an encrypted vault, while the service on the other side only stores the public key. When you sign in, you sign a challenge instead of sending a secret.

That is where the biggest difference with passwords lies. A phishing page cannot ask for or imitate a passkey, and a leaked database contains nothing usable. Windows now also supports external passkey managers such as 1Password and Bitwarden, so your keys sync encrypted between your PC and your smartphone. The sign-in itself happens through Windows Hello: face, finger or PIN. Anyone who has ever logged in with a confirmation on their smartphone knows how smooth that feels.

What do you realistically need?

Passwordless working is not a box you tick. The foundations: Microsoft Entra ID as the identity source, Conditional Access that decides under which conditions someone gets in, and devices that meet your compliance rules. For most SMEs, those components are in Microsoft 365 Business Premium, the licence we already see with the majority of our customers.

Count on the edge cases too. For shared devices or shift workers there are FIDO2 security keys: a physical key like a house or car key, with a PIN as an extra check. Anyone who cannot or does not want to use biometrics keeps the PIN. And be honest about the flip side: a failed passwordless sign-in feels more final than a forgotten password. Make sure there is a working recovery path before you switch off the classic password login.

The costs are reasonable. If you have Business Premium today, there are hardly any extra licence costs; the investment is configuration, a pilot and guiding your people. That is not a sales pitch, just how it works.

Where should you start?

Four steps, in order:

1. Inventory which accounts and devices are already ready for Windows Hello for Business. In most organisations that is more than you expect.
2. Get MFA and Conditional Access properly set up first. Passwordless working builds on those foundations, not next to them.
3. Start with a pilot group, your own team for instance. Fix what rubs in practice before you roll out.
4. Roll out per group and only switch off the classic password login once everyone can go passwordless.

How Dunetrails helps

We guide the entire transition: an inventory of your tenant, the right Conditional Access rules, a pilot that surfaces the edge cases and a rollout in which your people are not left stranded. On your side it mostly takes a decision; the majority of the work is configuration.

Or first test for free whether your e-mail domain can be spoofed: the email scan takes 2 seconds.