Passkeys for Canadian SMBs: Moving Beyond Passwords in Microsoft 365 and Beyond

The average Canadian data breach now costs CA$7.11 million — a record high — and at the centre of most breaches is a stolen password, a bypassed MFA code, or a session token lifted by an adversary-in-the-middle attack. The IBM Cost of a Data Breach Report 2026 identifies phishing as the top initial attack vector in Canada. The Verizon 2026 Data Breach Investigations Report finds credential abuse present at some stage in 39 percent of all confirmed breaches.

Passwords are the problem. Passkeys are increasingly the answer — and in 2026, the migration became concrete for every Canadian organization running Microsoft 365.

What Changed in 2026

Three developments in the first half of the year moved passkeys from a niche enterprise feature to an active deployment priority for Canadian SMBs.

Microsoft auto-enabled passkey profiles across all Entra ID tenants. In March 2026, Microsoft enabled passkey profile support organization-wide across every Entra ID tenant — meaning the infrastructure for phishing-resistant authentication now exists in every Microsoft 365 environment, regardless of licence tier, at no additional cost. Hundreds of millions of users already sign in daily with passkeys across Microsoft consumer services including OneDrive, Xbox, and Copilot, and the FIDO Alliance estimates 5 billion passkeys in use worldwide. (Microsoft Security Blog — World Passkey Day)

The CCCS published dedicated passkey guidance. On April 21, 2026, the Canadian Centre for Cyber Security released ITSAP.30.033, *Cyber Security Considerations for Passkeys*, covering types of passkeys, security tradeoffs between synced and device-bound credentials, and implementation recommendations for Canadian organizations. (CCCS ITSAP.30.033) This is the authoritative Canadian government guidance document on the subject, sitting alongside the existing MFA guidance in ITSAP.30.030 and the AiTM defence guidance in ITSM.30.031.

Canadian cyber insurers reclassified SMS-based MFA. Major Canadian carriers updated their underwriting standards to distinguish between phishing-resistant authentication (FIDO2 security keys, passkeys) and first-generation MFA (SMS codes, push notifications). Several carriers now require phishing-resistant MFA for privileged accounts, email, and VPN as a condition of coverage — and basic SMS or authenticator-app MFA is no longer sufficient for those accounts under the revised terms.

Why Your Existing MFA Is No Longer Sufficient

Multi-factor authentication was a meaningful improvement over passwords alone. It is no longer a sufficient defence on its own — and the CCCS documented more than 100 adversary-in-the-middle (AiTM) phishing campaigns targeting Canadian Microsoft Entra tenants between 2023 and early 2025.

AiTM attacks do not steal passwords. They steal the authenticated session tokens that MFA produces. The attack sequence is direct:

1. A user clicks a phishing link and lands on a realistic reverse-proxy of the Microsoft sign-in page

2. The user enters credentials and completes MFA — the proxy forwards those inputs to the real Microsoft server in real time

3. Microsoft returns an authenticated session token — which the attacker's proxy captures

4. The attacker replays that token in a separate browser session and is authenticated as the user, with full access

MFA was satisfied. The attacker is in.

The CIRA 2025 Cybersecurity Survey found that 42 percent of Canadian organizations experienced a breach in the past 12 months — up from 29 percent in 2022. AI-generated phishing emails now achieve click-through rates as high as 54 percent, according to Microsoft's analysis of threat telemetry across its global tenant base. (Microsoft Security Blog) The volume of attacks is growing, the sophistication of phishing lures is growing, and the authentication method most Canadian SMBs deployed to address the threat is the one attackers have learned to bypass.

What Passkeys Actually Are

A passkey is a cryptographic credential — technically a FIDO2-compliant asymmetric key pair — that replaces a password at sign-in. The user never creates or types a password. Authentication happens through a device they physically control (a laptop, a phone, a hardware security key) and biometric verification (fingerprint, face scan) or device PIN.

The property that defeats AiTM attacks is *origin binding*. A passkey is cryptographically tied to the specific domain it was created for. If an attacker operates a proxy domain to intercept a sign-in, the passkey refuses to authenticate: the domain does not match. There is no credential to capture, no session token that can be stolen at sign-in. The AiTM attack chain breaks at the first step.

There are two types, and the CCCS ITSAP.30.033 guidance explicitly distinguishes between them:

Synced passkeys are stored in a password manager or cloud keychain (Microsoft Password Manager, Apple Keychain, Google Password Manager) and synchronize across the user's devices. They are phishing-resistant, convenient, and appropriate for most end-user accounts. Microsoft auto-enabled passkey profile creation across all Entra tenants in March 2026, so your users can already create and use synced passkeys for Microsoft 365 sign-in today.

Device-bound passkeys (FIDO2 hardware security keys, such as YubiKey or Microsoft-compatible hardware tokens) are physically locked to one device and cannot be exported or cloned. The CCCS recommends device-bound passkeys for high-value accounts — administrators, finance team members with payment authority, executives — where the risk profile justifies the additional control and the cost of compromise is disproportionate.

Passkeys achieve a 93 percent sign-in success rate compared to 63 percent for traditional passwords — fewer failed logins, fewer password resets, fewer help desk calls. The operational benefits compound the security case.

The PIPEDA and Cyber Insurance Angles

PIPEDA accountability. Under PIPEDA, organizations must implement security safeguards appropriate to the sensitivity of the personal information they hold. The Office of the Privacy Commissioner's breach reporting guidance requires notification to the OPC and to affected individuals when a breach creates a real risk of significant harm. Password-based authentication for systems holding customer personal information is increasingly difficult to justify as an "appropriate safeguard" when phishing-resistant alternatives are free to deploy in Microsoft 365 and explicitly recommended by the Canadian government. A credential-based breach — an attacker using a stolen or phished password to access a customer database — triggers mandatory breach reporting. Eliminating the credential is the most direct way to eliminate that reporting risk.

Cyber insurance underwriting. The cyber insurance requirements facing Canadian SMBs have shifted materially in 2025 and 2026. Insurers now distinguish between phishing-resistant authentication and legacy forms. An organization operating on SMS-based or push-notification MFA for email and VPN may face higher premiums, reduced coverage, or claim disputes if an AiTM attack bypasses that MFA and results in a financial loss or data breach. Deploying passkeys for privileged and finance accounts — those that control funds and sensitive data — is the authentication posture most underwriters now expect for competitive coverage terms.

Practical Deployment Steps for Canadian SMBs

The migration is more manageable than it sounds. Microsoft has built the infrastructure; the work is configuration and rollout.

Step 1: Enable passkeys in the Authentication Methods policy. In the Microsoft Entra admin center (entra.microsoft.com), navigate to Protection → Authentication Methods → Passkey (FIDO2). Enable the policy and scope it to a pilot group first. This is a configuration change — passkeys are available in every Entra ID edition including Free, with no additional licences required. (Microsoft Learn — Passkeys in Entra ID)

Step 2: Require hardware keys for administrators and finance accounts. Purchase FIDO2 hardware security keys for any account with administrative privilege, wire transfer authority, or access to sensitive regulated data. A YubiKey 5 Series costs roughly CA$65–90 per unit — trivial against the cost of one compromised admin account. The CCCS ITSAP.30.033 guidance supports this tiered approach, reserving device-bound passkeys for the accounts that carry disproportionate organizational risk.

Step 3: Roll out synced passkeys to the general workforce. Once administrators are on hardware keys, enable synced passkeys for all users. Microsoft Password Manager supports passkey creation and sync on iOS and Android, with the same credentials working on desktop browsers in Windows 11 and macOS. Guide users through creating a passkey during a scheduled security update — the process takes approximately two minutes per device.

Step 4: Disable legacy authentication for migrated accounts. Once a user has a registered passkey, remove SMS and voice call as fallback authentication methods. Leaving legacy fallback methods active partially negates the phishing-resistant protection — an attacker who can trigger account recovery through a phone-based method can still compromise an account that has a passkey registered. The migration is only complete when the weaker fallbacks are removed.

Step 5: Plan for the January 2027 deadline. Microsoft is eliminating security questions as a password reset option in Entra ID in January 2027. Organizations still relying on security questions for account recovery need a migration plan for that fallback path before the deadline. Microsoft Entra ID account recovery using government-issued identity verification is the high-assurance replacement. (Microsoft Security Blog)

What the Deployment Data Shows

Microsoft has achieved 99.6 percent coverage of its own users and devices with phishing-resistant authentication — demonstrating at scale that full organizational migration is achievable, not aspirational. The FIDO Alliance reports 1.3 billion passkey authentications per month globally, double the figure from a year earlier.

The Verizon 2026 DBIR found that 50 percent of ransomware victims had a credential or infostealer event within 95 days prior to their attack. Passkeys do not prevent malware from running on a device, and they are not a complete security posture on their own. But they eliminate the credential theft and phishing-bypass attack chain that precedes a significant share of the ransomware incidents Canadian SMBs are paying, on average, CA$7.11 million to recover from. (IBM Cost of a Data Breach 2026)

The infrastructure is already in your Microsoft 365 tenant. The CCCS guidance is published. Canadian insurers are updating their requirements. The deployment work is measured in hours, not months. There is no remaining argument for delay.

Sources

• Canadian Centre for Cyber Security. *Cyber security considerations for passkeys (ITSAP.30.033).* cyber.gc.ca, April 21, 2026
• Canadian Centre for Cyber Security. *Defending against adversary-in-the-middle threats with phishing-resistant MFA (ITSM.30.031).* cyber.gc.ca
• Canadian Centre for Cyber Security. *Secure your accounts and devices with multi-factor authentication (ITSAP.30.030).* cyber.gc.ca
• IBM. *Cost of a Data Breach Report 2026 — Canada findings.* Newswire.ca
• CIRA. *2025 Cybersecurity Survey.* cira.ca
• Verizon. *2026 Data Breach Investigations Report.* verizon.com
• Microsoft. *World Passkey Day: Advancing passwordless authentication.* Microsoft Security Blog, May 7, 2026
• Microsoft Learn. *Passkeys (FIDO2) authentication in Microsoft Entra ID.* learn.microsoft.com
• Office of the Privacy Commissioner of Canada. *PIPEDA — Breach of Security Safeguards Regulations.* priv.gc.ca
• Gamtech. *Cyber Insurance Canada 2026: SMB Requirements and Claim Denials.* gamtech.ca

Cloud Forces helps Canadian SMBs configure phishing-resistant authentication in Microsoft Entra ID, deploy FIDO2 hardware keys for privileged accounts, and build the access control policies that satisfy PIPEDA's reasonable safeguards obligation and cyber insurance underwriting requirements. Explore our Cybersecurity services or contact us to book a no-cost authentication assessment.