If two-factor authentication is the safety net under the password, passkeys are the thing that does away with the password altogether. They are where the whole industry is heading, and for good reason: a passkey cannot be guessed, cannot be reused, and crucially cannot be phished. Even if a member of staff clicks a fake Microsoft login link and tries to sign in, the passkey simply will not work on the fake site.
This guide explains what a passkey is in plain terms, why it is so much safer, and what moving to them realistically looks like for a nursery. It is not a Monday-morning task. It is a direction of travel, and this is the map.
A password is a secret you know and type in. That is its weakness: anything you can type, you can be tricked into typing somewhere you shouldn’t, and anything stored on a server can leak.
A passkey is different. Instead of a secret you remember, it is a secure key stored on your device, your phone, most often, and unlocked by the thing you already use to unlock the phone: your face, your fingerprint, or the phone’s PIN. When you sign in, the website and your phone do a quick cryptographic handshake to prove it is really you. There is no secret to type, nothing to write down, and nothing sitting on a server waiting to be stolen in a breach.
You are probably already using something like this without calling it a passkey. Unlocking your banking app with your fingerprint is the same idea.
This is the part that matters most for a nursery, because phishing is how most attacks start.
A password can be phished because it is portable. If a fake site looks convincing enough, a busy member of staff will type the real password into it, and now the attacker has it. A passkey cannot be handed over this way, because it is tied to the genuine website’s actual address. Click a link to a fake Microsoft page, and the passkey will not even offer to sign you in, because the address is wrong. The very thing that makes phishing work, tricking a human into typing a secret, has nothing to grab hold of.
So even on the bad morning when someone does click the link they shouldn’t, the passkey holds the line. That is the layered defence the talk was about: people get phished, but the passwords layer means the attacker still cannot get in.
For most nurseries, the phone is the passkey. A member of staff sets up a passkey for Microsoft 365 once, stored on their phone and protected by their face, fingerprint or PIN. From then on, signing in on the work computer prompts a tap on their phone to approve, much like a banking app. No password typed, no code copied across, just a confirmation on a device only they can unlock.
Microsoft 365 supports passkeys today, so this is not a future promise, it is something you can begin with the accounts you already have. Most staff already carry a phone perfectly capable of it.
This is the objection everyone raises, and it is a fair one: if the passkey is on the phone, what happens when someone loses the phone, or it dies, or they get a new one? Are they locked out?
The answer is to not let the passkey live in only one place. A password manager like Keeper can generate, store and sync passkeys across devices, so the passkey is not trapped on a single handset. Lose the phone, sign into Keeper on the new one, and the passkeys are there. It turns the lost-phone scenario from a lockout into a five-minute restore, and it is the reason we suggest pairing passkeys with a password manager rather than relying on the phone alone.
This is the same Keeper that solves the shared-password and leaver problems in the Leavers guide, which is part of why it earns its place: one tool quietly doing several jobs.
Nurseries do not work like offices. A computer in a room might be used by several staff across a day, which raises a reasonable worry about how a personal passkey fits a shared machine.
The honest answer is that passkeys work best with personal accounts on personal-ish access, and shared devices need a bit of thought rather than a blanket rollout. In practice this usually means each person signing in with their own account and their own passkey on their phone even when the computer is shared, which is also better practice than a single login everyone uses. Where a genuinely shared, always-on account is unavoidable, that is worth a specific conversation rather than forcing passkeys into a shape they do not fit. It is one of the reasons this is a phased move, not a switch you throw overnight.
Be honest with yourself about the timescale. Moving a nursery to passkeys is a three-to-six-month transition, not a task for this week, and that is completely fine.
A sensible order looks like this. Start by getting the foundations right: 2FA on everywhere, a password manager in place, everyone on their own named account. Then introduce passkeys for the people with the most access first, the owner and managers, because their accounts matter most. Let it bed in, learn the lost-phone and shared-device wrinkles on a small group, then widen it out room by room at a pace that does not disrupt the actual job of running the nursery.
Nobody needs to be rushed. The goal is steady movement in the right direction, not a dramatic weekend.
Octopus 365 has supported nurseries since 2011, and James has worked with early years settings since 2009. If you’d like to talk through what a passkey rollout would look like for your setting, or just where to sensibly start, get in touch any time. No hard sell, just a conversation.